Re: [PATCH v2 1/1] RDMA/rxe: Fix Use-After-Free problem in rxe_net_del

[Zhu Yanjun <yanjun.zhu@linux.dev>]

在 2026/6/2 18:25, Jason Gunthorpe 写道:
> On Tue, May 19, 2026 at 04:35:41AM +0200, Zhu Yanjun wrote:
>
>> index 50a2cb5405e2..0bf5b0eabc7b 100644
>> --- a/drivers/infiniband/sw/rxe/rxe_net.c
>> +++ b/drivers/infiniband/sw/rxe/rxe_net.c
>> @@ -135,13 +135,21 @@ static struct dst_entry *rxe_find_route6(struct rxe_qp *qp,
>>   {
>>   	struct dst_entry *ndst;
>>   	struct flowi6 fl6 = {};
>> +	struct sock *sk;
>>   
>>   	fl6.flowi6_oif = ndev->ifindex;
>>   	memcpy(&fl6.saddr, saddr, sizeof(*saddr));
>>   	memcpy(&fl6.daddr, daddr, sizeof(*daddr));
>>   	fl6.flowi6_proto = IPPROTO_UDP;
>>   
>> -	ndst = ip6_dst_lookup_flow(net, rxe_ns_pernet_sk6(net), &fl6, NULL);
>> +	rxe_ns_lock(net);
>> +	sk = rxe_ns_pernet_sk6(net);
>> +	if (sk)
>> +		sock_hold(sk);
>> +	rxe_ns_unlock(net);
>> +
>> +	ndst = ip6_dst_lookup_flow(net, sk, &fl6, NULL);
>> +	sock_put(sk);
> Sashiko says this crashes when sk is null, which it can be.
>
> But this really seems weird, the rxe can be in only one namespace, why
> not reach the listening sks associated with the ib_dev through
> qp->pd->dev and not do net lookups?
>
> I would expect net lookups to only exist in the add/del link paths?

Thanks a lot. I will send out the new patch, following your advice.

Zhu Yanjun

>
> Jason

-- 
Best Regards,
Yanjun.Zhu