[PATCH 1/1] RDMA/rxe: Fix unsafe socket release during namespace cleanup

[PATCH 1/1] RDMA/rxe: Fix unsafe socket release during namespace cleanup

[Zhu Yanjun]

Since all the sockets are created in rdma link create command
and destroyed in rdma link delete command, keeping
udp_tunnel_sock_release in rxe_ns_exit risks a "double-free" if
the namespace and the device are being cleaned up simultaneously.

Fixes: 13f2a53c2a71 ("RDMA/rxe: Add net namespace support for IPv4/IPv6 sockets")
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
---
 drivers/infiniband/sw/rxe/rxe_ns.c | 20 --------------------
 1 file changed, 20 deletions(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_ns.c b/drivers/infiniband/sw/rxe/rxe_ns.c
index 8b9d734229b2..53add78b8e3a 100644
--- a/drivers/infiniband/sw/rxe/rxe_ns.c
+++ b/drivers/infiniband/sw/rxe/rxe_ns.c
@@ -39,26 +39,6 @@ static void rxe_ns_exit(struct net *net)
 {
 	/* called when the network namespace is removed
 	 */
-	struct rxe_ns_sock *ns_sk = net_generic(net, rxe_pernet_id);
-	struct sock *sk;
-
-	rcu_read_lock();
-	sk = rcu_dereference(ns_sk->rxe_sk4);
-	rcu_read_unlock();
-	if (sk) {
-		rcu_assign_pointer(ns_sk->rxe_sk4, NULL);
-		udp_tunnel_sock_release(sk->sk_socket);
-	}
-
-#if IS_ENABLED(CONFIG_IPV6)
-	rcu_read_lock();
-	sk = rcu_dereference(ns_sk->rxe_sk6);
-	rcu_read_unlock();
-	if (sk) {
-		rcu_assign_pointer(ns_sk->rxe_sk6, NULL);
-		udp_tunnel_sock_release(sk->sk_socket);
-	}
-#endif
 }
 
 /*
-- 
2.43.0

Re: [PATCH 1/1] RDMA/rxe: Fix unsafe socket release during namespace cleanup

[Leon Romanovsky]

On Fri, Apr 24, 2026 at 06:35:22AM +0200, Zhu Yanjun wrote:
> Since all the sockets are created in rdma link create command
> and destroyed in rdma link delete command, keeping
> udp_tunnel_sock_release in rxe_ns_exit risks a "double-free" if
> the namespace and the device are being cleaned up simultaneously.

Please add a ladder diagram to clarify how it can be possible.

Thanks

> 
> Fixes: 13f2a53c2a71 ("RDMA/rxe: Add net namespace support for IPv4/IPv6 sockets")
> Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
> ---
>  drivers/infiniband/sw/rxe/rxe_ns.c | 20 --------------------
>  1 file changed, 20 deletions(-)
> 
> diff --git a/drivers/infiniband/sw/rxe/rxe_ns.c b/drivers/infiniband/sw/rxe/rxe_ns.c
> index 8b9d734229b2..53add78b8e3a 100644
> --- a/drivers/infiniband/sw/rxe/rxe_ns.c
> +++ b/drivers/infiniband/sw/rxe/rxe_ns.c
> @@ -39,26 +39,6 @@ static void rxe_ns_exit(struct net *net)
>  {
>  	/* called when the network namespace is removed
>  	 */
> -	struct rxe_ns_sock *ns_sk = net_generic(net, rxe_pernet_id);
> -	struct sock *sk;
> -
> -	rcu_read_lock();
> -	sk = rcu_dereference(ns_sk->rxe_sk4);
> -	rcu_read_unlock();
> -	if (sk) {
> -		rcu_assign_pointer(ns_sk->rxe_sk4, NULL);
> -		udp_tunnel_sock_release(sk->sk_socket);
> -	}
> -
> -#if IS_ENABLED(CONFIG_IPV6)
> -	rcu_read_lock();
> -	sk = rcu_dereference(ns_sk->rxe_sk6);
> -	rcu_read_unlock();
> -	if (sk) {
> -		rcu_assign_pointer(ns_sk->rxe_sk6, NULL);
> -		udp_tunnel_sock_release(sk->sk_socket);
> -	}
> -#endif
>  }
>  
>  /*
> -- 
> 2.43.0
> 
> 

Re: [PATCH 1/1] RDMA/rxe: Fix unsafe socket release during namespace cleanup

[yanjun.zhu]

On 4/27/26 5:35 AM, Leon Romanovsky wrote:
> On Fri, Apr 24, 2026 at 06:35:22AM +0200, Zhu Yanjun wrote:
>> Since all the sockets are created in rdma link create command
>> and destroyed in rdma link delete command, keeping
>> udp_tunnel_sock_release in rxe_ns_exit risks a "double-free" if
>> the namespace and the device are being cleaned up simultaneously.
> 
> Please add a ladder diagram to clarify how it can be possible.

Hi, Leon

The double-free occurs as follows:

CPU 0 (Net NameSpace cleanup)        CPU 1 (RDMA device removal)
---------------------                ---------------------------
rxe_ns_exit()                        rxe_link_delete() (rdma link del )
   -> sk = ns_sk->rxe_sk4               -> sk = ns_sk->rxe_sk4
   -> udp_tunnel_sock_release(sk)
      [Success: First Free]             -> udp_tunnel_sock_release(sk)
                                           [Crash: Double Free]

After removing the socket release logic from rxe_ns_exit(), we ensure
that only the device destruction path (rxe_link_delete) is responsible
for freeing the tunnel sockets, effectively eliminating the double-free 
problem.

I am not sure if I should put the above into the commit log.

Thanks a lot.

Zhu Yanjun

> 
> Thanks
> 
>>
>> Fixes: 13f2a53c2a71 ("RDMA/rxe: Add net namespace support for IPv4/IPv6 sockets")
>> Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
>> ---
>>   drivers/infiniband/sw/rxe/rxe_ns.c | 20 --------------------
>>   1 file changed, 20 deletions(-)
>>
>> diff --git a/drivers/infiniband/sw/rxe/rxe_ns.c b/drivers/infiniband/sw/rxe/rxe_ns.c
>> index 8b9d734229b2..53add78b8e3a 100644
>> --- a/drivers/infiniband/sw/rxe/rxe_ns.c
>> +++ b/drivers/infiniband/sw/rxe/rxe_ns.c
>> @@ -39,26 +39,6 @@ static void rxe_ns_exit(struct net *net)
>>   {
>>   	/* called when the network namespace is removed
>>   	 */
>> -	struct rxe_ns_sock *ns_sk = net_generic(net, rxe_pernet_id);
>> -	struct sock *sk;
>> -
>> -	rcu_read_lock();
>> -	sk = rcu_dereference(ns_sk->rxe_sk4);
>> -	rcu_read_unlock();
>> -	if (sk) {
>> -		rcu_assign_pointer(ns_sk->rxe_sk4, NULL);
>> -		udp_tunnel_sock_release(sk->sk_socket);
>> -	}
>> -
>> -#if IS_ENABLED(CONFIG_IPV6)
>> -	rcu_read_lock();
>> -	sk = rcu_dereference(ns_sk->rxe_sk6);
>> -	rcu_read_unlock();
>> -	if (sk) {
>> -		rcu_assign_pointer(ns_sk->rxe_sk6, NULL);
>> -		udp_tunnel_sock_release(sk->sk_socket);
>> -	}
>> -#endif
>>   }
>>   
>>   /*
>> -- 
>> 2.43.0
>>
>>

Re: [PATCH 1/1] RDMA/rxe: Fix unsafe socket release during namespace cleanup

[Leon Romanovsky]

On Mon, Apr 27, 2026 at 01:52:17PM -0700, yanjun.zhu wrote:
> On 4/27/26 5:35 AM, Leon Romanovsky wrote:
> > On Fri, Apr 24, 2026 at 06:35:22AM +0200, Zhu Yanjun wrote:
> > > Since all the sockets are created in rdma link create command
> > > and destroyed in rdma link delete command, keeping
> > > udp_tunnel_sock_release in rxe_ns_exit risks a "double-free" if
> > > the namespace and the device are being cleaned up simultaneously.
> > 
> > Please add a ladder diagram to clarify how it can be possible.
> 
> Hi, Leon
> 
> The double-free occurs as follows:
> 
> CPU 0 (Net NameSpace cleanup)        CPU 1 (RDMA device removal)
> ---------------------                ---------------------------
> rxe_ns_exit()                        rxe_link_delete() (rdma link del )
>   -> sk = ns_sk->rxe_sk4               -> sk = ns_sk->rxe_sk4
>   -> udp_tunnel_sock_release(sk)
>      [Success: First Free]             -> udp_tunnel_sock_release(sk)
>                                           [Crash: Double Free]
> 
> After removing the socket release logic from rxe_ns_exit(), we ensure
> that only the device destruction path (rxe_link_delete) is responsible
> for freeing the tunnel sockets, effectively eliminating the double-free
> problem.

I think it is possible to call rxe_ns_exit() without invoking
rxe_link_delete(), and in that case the UDP socket will not be
destroyed.

Thanks

> 
> I am not sure if I should put the above into the commit log.
> 
> Thanks a lot.
> 
> Zhu Yanjun
> 
> > 
> > Thanks
> > 
> > > 
> > > Fixes: 13f2a53c2a71 ("RDMA/rxe: Add net namespace support for IPv4/IPv6 sockets")
> > > Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
> > > ---
> > >   drivers/infiniband/sw/rxe/rxe_ns.c | 20 --------------------
> > >   1 file changed, 20 deletions(-)
> > > 
> > > diff --git a/drivers/infiniband/sw/rxe/rxe_ns.c b/drivers/infiniband/sw/rxe/rxe_ns.c
> > > index 8b9d734229b2..53add78b8e3a 100644
> > > --- a/drivers/infiniband/sw/rxe/rxe_ns.c
> > > +++ b/drivers/infiniband/sw/rxe/rxe_ns.c
> > > @@ -39,26 +39,6 @@ static void rxe_ns_exit(struct net *net)
> > >   {
> > >   	/* called when the network namespace is removed
> > >   	 */
> > > -	struct rxe_ns_sock *ns_sk = net_generic(net, rxe_pernet_id);
> > > -	struct sock *sk;
> > > -
> > > -	rcu_read_lock();
> > > -	sk = rcu_dereference(ns_sk->rxe_sk4);
> > > -	rcu_read_unlock();
> > > -	if (sk) {
> > > -		rcu_assign_pointer(ns_sk->rxe_sk4, NULL);
> > > -		udp_tunnel_sock_release(sk->sk_socket);
> > > -	}
> > > -
> > > -#if IS_ENABLED(CONFIG_IPV6)
> > > -	rcu_read_lock();
> > > -	sk = rcu_dereference(ns_sk->rxe_sk6);
> > > -	rcu_read_unlock();
> > > -	if (sk) {
> > > -		rcu_assign_pointer(ns_sk->rxe_sk6, NULL);
> > > -		udp_tunnel_sock_release(sk->sk_socket);
> > > -	}
> > > -#endif
> > >   }
> > >   /*
> > > -- 
> > > 2.43.0
> > > 
> > > 
> 

Re: [PATCH 1/1] RDMA/rxe: Fix unsafe socket release during namespace cleanup

[Zhu Yanjun]

在 2026/4/28 7:26, Leon Romanovsky 写道:
> On Mon, Apr 27, 2026 at 01:52:17PM -0700, yanjun.zhu wrote:
>> On 4/27/26 5:35 AM, Leon Romanovsky wrote:
>>> On Fri, Apr 24, 2026 at 06:35:22AM +0200, Zhu Yanjun wrote:
>>>> Since all the sockets are created in rdma link create command
>>>> and destroyed in rdma link delete command, keeping
>>>> udp_tunnel_sock_release in rxe_ns_exit risks a "double-free" if
>>>> the namespace and the device are being cleaned up simultaneously.
>>>
>>> Please add a ladder diagram to clarify how it can be possible.
>>
>> Hi, Leon
>>
>> The double-free occurs as follows:
>>
>> CPU 0 (Net NameSpace cleanup)        CPU 1 (RDMA device removal)
>> ---------------------                ---------------------------
>> rxe_ns_exit()                        rxe_link_delete() (rdma link del )
>>    -> sk = ns_sk->rxe_sk4               -> sk = ns_sk->rxe_sk4
>>    -> udp_tunnel_sock_release(sk)
>>       [Success: First Free]             -> udp_tunnel_sock_release(sk)
>>                                            [Crash: Double Free]
>>
>> After removing the socket release logic from rxe_ns_exit(), we ensure
>> that only the device destruction path (rxe_link_delete) is responsible
>> for freeing the tunnel sockets, effectively eliminating the double-free
>> problem.
> 
> I think it is possible to call rxe_ns_exit() without invoking
> rxe_link_delete(), and in that case the UDP socket will not be
> destroyed.

Thanks, my bad. I missed this scenario.

Zhu Yanjun

> 
> Thanks
> 
>>
>> I am not sure if I should put the above into the commit log.
>>
>> Thanks a lot.
>>
>> Zhu Yanjun
>>
>>>
>>> Thanks
>>>
>>>>
>>>> Fixes: 13f2a53c2a71 ("RDMA/rxe: Add net namespace support for IPv4/IPv6 sockets")
>>>> Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
>>>> ---
>>>>    drivers/infiniband/sw/rxe/rxe_ns.c | 20 --------------------
>>>>    1 file changed, 20 deletions(-)
>>>>
>>>> diff --git a/drivers/infiniband/sw/rxe/rxe_ns.c b/drivers/infiniband/sw/rxe/rxe_ns.c
>>>> index 8b9d734229b2..53add78b8e3a 100644
>>>> --- a/drivers/infiniband/sw/rxe/rxe_ns.c
>>>> +++ b/drivers/infiniband/sw/rxe/rxe_ns.c
>>>> @@ -39,26 +39,6 @@ static void rxe_ns_exit(struct net *net)
>>>>    {
>>>>    	/* called when the network namespace is removed
>>>>    	 */
>>>> -	struct rxe_ns_sock *ns_sk = net_generic(net, rxe_pernet_id);
>>>> -	struct sock *sk;
>>>> -
>>>> -	rcu_read_lock();
>>>> -	sk = rcu_dereference(ns_sk->rxe_sk4);
>>>> -	rcu_read_unlock();
>>>> -	if (sk) {
>>>> -		rcu_assign_pointer(ns_sk->rxe_sk4, NULL);
>>>> -		udp_tunnel_sock_release(sk->sk_socket);
>>>> -	}
>>>> -
>>>> -#if IS_ENABLED(CONFIG_IPV6)
>>>> -	rcu_read_lock();
>>>> -	sk = rcu_dereference(ns_sk->rxe_sk6);
>>>> -	rcu_read_unlock();
>>>> -	if (sk) {
>>>> -		rcu_assign_pointer(ns_sk->rxe_sk6, NULL);
>>>> -		udp_tunnel_sock_release(sk->sk_socket);
>>>> -	}
>>>> -#endif
>>>>    }
>>>>    /*
>>>> -- 
>>>> 2.43.0
>>>>
>>>>
>>

Re: [PATCH 1/1] RDMA/rxe: Fix unsafe socket release during namespace cleanup

[yanjun.zhu]

On 4/29/26 6:49 AM, Zhu Yanjun wrote:
> 在 2026/4/28 7:26, Leon Romanovsky 写道:
>> On Mon, Apr 27, 2026 at 01:52:17PM -0700, yanjun.zhu wrote:
>>> On 4/27/26 5:35 AM, Leon Romanovsky wrote:
>>>> On Fri, Apr 24, 2026 at 06:35:22AM +0200, Zhu Yanjun wrote:
>>>>> Since all the sockets are created in rdma link create command
>>>>> and destroyed in rdma link delete command, keeping
>>>>> udp_tunnel_sock_release in rxe_ns_exit risks a "double-free" if
>>>>> the namespace and the device are being cleaned up simultaneously.
>>>>
>>>> Please add a ladder diagram to clarify how it can be possible.
>>>
>>> Hi, Leon
>>>
>>> The double-free occurs as follows:
>>>
>>> CPU 0 (Net NameSpace cleanup)        CPU 1 (RDMA device removal)
>>> ---------------------                ---------------------------
>>> rxe_ns_exit()                        rxe_link_delete() (rdma link del )
>>>    -> sk = ns_sk->rxe_sk4               -> sk = ns_sk->rxe_sk4
>>>    -> udp_tunnel_sock_release(sk)
>>>       [Success: First Free]             -> udp_tunnel_sock_release(sk)
>>>                                            [Crash: Double Free]
>>>
>>> After removing the socket release logic from rxe_ns_exit(), we ensure
>>> that only the device destruction path (rxe_link_delete) is responsible
>>> for freeing the tunnel sockets, effectively eliminating the double-free
>>> problem.
>>
>> I think it is possible to call rxe_ns_exit() without invoking
>> rxe_link_delete(), and in that case the UDP socket will not be
>> destroyed.
> 
> Thanks, my bad. I missed this scenario.
> 
> Zhu Yanjun
> 
>>
>> Thanks
>>
>>>
>>> I am not sure if I should put the above into the commit log.
>>>
>>> Thanks a lot.

Hi, Leon

I have performed further tests to verify the execution order and the 
necessity of the cleanup code in rxe_ns_exit().

My findings show that a double-free race condition is unlikely because 
of how the kernel manages namespace references:

Reference Dependency: The RXE RDMA link holds a reference to the network 
namespace.

Order of Execution: When a namespace is deleted while an RDMA link 
exists, rxe_ns_exit() is not invoked immediately. It is deferred until 
the RDMA link itself is deleted (e.g., via rdma link del), which drops 
the final reference count of the namespace.

Redundancy: Consequently, rxe_ns_exit() always follows the device 
cleanup path (rxe_link_delete). Since all tunnel sockets are already 
released during the device cleanup, the code in rxe_ns_exit() is 
redundant and does nothing.

Removing this code simplifies the driver by centralizing socket 
destruction in the device management path, where the sockets are 
originally created.

This ensures that we don't attempt to release the same resources twice, 
even if the destruction is technically serialized by the kernel's 
reference counting.

What are your thoughts on this observation?

Thanks,

Zhu Yanjun

>>>
>>> Zhu Yanjun
>>>
>>>>
>>>> Thanks
>>>>
>>>>>
>>>>> Fixes: 13f2a53c2a71 ("RDMA/rxe: Add net namespace support for IPv4/ 
>>>>> IPv6 sockets")
>>>>> Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
>>>>> ---
>>>>>    drivers/infiniband/sw/rxe/rxe_ns.c | 20 --------------------
>>>>>    1 file changed, 20 deletions(-)
>>>>>
>>>>> diff --git a/drivers/infiniband/sw/rxe/rxe_ns.c b/drivers/ 
>>>>> infiniband/sw/rxe/rxe_ns.c
>>>>> index 8b9d734229b2..53add78b8e3a 100644
>>>>> --- a/drivers/infiniband/sw/rxe/rxe_ns.c
>>>>> +++ b/drivers/infiniband/sw/rxe/rxe_ns.c
>>>>> @@ -39,26 +39,6 @@ static void rxe_ns_exit(struct net *net)
>>>>>    {
>>>>>        /* called when the network namespace is removed
>>>>>         */
>>>>> -    struct rxe_ns_sock *ns_sk = net_generic(net, rxe_pernet_id);
>>>>> -    struct sock *sk;
>>>>> -
>>>>> -    rcu_read_lock();
>>>>> -    sk = rcu_dereference(ns_sk->rxe_sk4);
>>>>> -    rcu_read_unlock();
>>>>> -    if (sk) {
>>>>> -        rcu_assign_pointer(ns_sk->rxe_sk4, NULL);
>>>>> -        udp_tunnel_sock_release(sk->sk_socket);
>>>>> -    }
>>>>> -
>>>>> -#if IS_ENABLED(CONFIG_IPV6)
>>>>> -    rcu_read_lock();
>>>>> -    sk = rcu_dereference(ns_sk->rxe_sk6);
>>>>> -    rcu_read_unlock();
>>>>> -    if (sk) {
>>>>> -        rcu_assign_pointer(ns_sk->rxe_sk6, NULL);
>>>>> -        udp_tunnel_sock_release(sk->sk_socket);
>>>>> -    }
>>>>> -#endif
>>>>>    }
>>>>>    /*
>>>>> -- 
>>>>> 2.43.0
>>>>>
>>>>>
>>>
>