Re: [PATCH 1/1] RDMA/rxe: Fix unsafe socket release during namespace cleanup

["yanjun.zhu" <yanjun.zhu@linux.dev>]

On 5/11/26 5:37 AM, Leon Romanovsky wrote:
> On Wed, Apr 29, 2026 at 04:31:48PM -0700, yanjun.zhu wrote:
>> Hi, Leon
>>
>> I have performed further tests to verify the execution order and the
>> necessity of the cleanup code in rxe_ns_exit().
>>
>> My findings show that a double-free race condition is unlikely because of
>> how the kernel manages namespace references:
>>
>> Reference Dependency: The RXE RDMA link holds a reference to the network
>> namespace.
>>
>> Order of Execution: When a namespace is deleted while an RDMA link exists,
>> rxe_ns_exit() is not invoked immediately. It is deferred until the RDMA link
>> itself is deleted (e.g., via rdma link del), which drops the final reference
>> count of the namespace.
> 
> AFAIC, we've seen syzkaller reports where "rdma link del" was never invoked,
> yet RXE was removed regardless. Is it possible?

Hi Leon,

Thanks for your feedback.

Regarding the case where "rdma link del" is not invoked, I’d like to 
share my observations on the namespace cleanup flow for RXE:

In my tests, when a network namespace is deleted (e.g., ip netns del), 
the RXE device (and its underlying net_device) is typically moved back 
to the init_net rather than being destroyed immediately. This is why the 
RDMA links still show up in init_net and the namespace reference count 
remains held.

As long as the device exists (even if moved), the resource cleanup is 
managed by the device's lifecycle. The rxe_ns_exit() only gets called 
when the last reference to that netns is dropped, which usually happens 
after the RXE device itself is finally deleted.

I haven't personally encountered the syzkaller reports where this logic 
fails or leads to a leak/crash. If possible, could you please share the 
specific syzkaller logs or the link to the report? It would be very 
helpful for me to understand if there is a specific corner case (e.g., 
driver unloading or abnormal netns teardown) where the per-net cleanup 
acts as a necessary "safety net."

If such a race exists, I will reconsider whether to keep the cleanup 
code or move it to a more robust location.

Best regards,
Yanjun Zhu

> 
> Thanks