Re: [RFC PATCH 1/2] RDMA/rxe: drive UDP tunnel socket lifetime from the GID table

[Serhat Kumral <serhatkumral1@gmail.com>]

> Don't get this, GID removal is asynchronous, so it will eventually
> complete, what is wrong with leaving the socks around but unsuable for
> a little bit? Does something break?

I checked this more closely. You are right that a kernel socket's
passive net reference keeps struct net itself allocated, so my
wording about closing the sockets before the net is freed was
inaccurate.

However, the passive reference does not defer the pernet exit
callbacks. cleanup_net runs those callbacks before dropping its base
passive reference. With CONFIG_PROC_FS, sock_inuse_exit_net() frees
net->core.prot_inuse; when per-netns UDP hash tables are enabled,
udp_pernet_table_free() also frees net->ipv4.udp_table. The eventual
udp_tunnel_sock_release() reaches udp_lib_unhash(), which accesses
this state while unhashing a still-hashed socket. A sufficiently
delayed close can therefore access freed pernet storage even though
struct net itself remains allocated.

The backstop is therefore intended to close any remaining hashed
sockets while the required protocol pernet state is still alive, not
to prevent a direct struct net UAF. I will reword the comment and
commit message accordingly in the next version.

Regarding the per-QP TX socket in init_net, agreed that it should be
investigated separately. I will keep that out of this series and look
at selecting the TX socket from the relevant GID/netns as a follow-up.