Re: [PATCH v2 1/1] RDMA/rxe: Fix Use-After-Free problem in rxe_net_del

[Zhu Yanjun <yanjun.zhu@linux.dev>]

在 2026/6/3 9:25, Jason Gunthorpe 写道:
> On Wed, Jun 03, 2026 at 08:43:31AM -0700, Zhu Yanjun wrote:
>>
>> 在 2026/6/2 18:25, Jason Gunthorpe 写道:
>>> On Tue, May 19, 2026 at 04:35:41AM +0200, Zhu Yanjun wrote:
>>>
>>>> index 50a2cb5405e2..0bf5b0eabc7b 100644
>>>> --- a/drivers/infiniband/sw/rxe/rxe_net.c
>>>> +++ b/drivers/infiniband/sw/rxe/rxe_net.c
>>>> @@ -135,13 +135,21 @@ static struct dst_entry *rxe_find_route6(struct rxe_qp *qp,
>>>>    {
>>>>    	struct dst_entry *ndst;
>>>>    	struct flowi6 fl6 = {};
>>>> +	struct sock *sk;
>>>>    	fl6.flowi6_oif = ndev->ifindex;
>>>>    	memcpy(&fl6.saddr, saddr, sizeof(*saddr));
>>>>    	memcpy(&fl6.daddr, daddr, sizeof(*daddr));
>>>>    	fl6.flowi6_proto = IPPROTO_UDP;
>>>> -	ndst = ip6_dst_lookup_flow(net, rxe_ns_pernet_sk6(net), &fl6, NULL);
>>>> +	rxe_ns_lock(net);
>>>> +	sk = rxe_ns_pernet_sk6(net);
>>>> +	if (sk)
>>>> +		sock_hold(sk);
>>>> +	rxe_ns_unlock(net);
>>>> +
>>>> +	ndst = ip6_dst_lookup_flow(net, sk, &fl6, NULL);
>>>> +	sock_put(sk);
>>> Sashiko says this crashes when sk is null, which it can be.
>>>
>>> But this really seems weird, the rxe can be in only one namespace, why
>>> not reach the listening sks associated with the ib_dev through
>>> qp->pd->dev and not do net lookups?
>>>
>>> I would expect net lookups to only exist in the add/del link paths?
>>
>> Thanks a lot. I will send out the new patch, following your advice.
> 
> I was thinking later I don't really know what rxe did here and normal
> rdma core code has multiple namespace flow. IIRC the namespace
> flows from the selected GID entry and the namespace mode selects how
> gid entries are created from namespaces.
> 
> So this still looks quite odd, by the time we get to RXE we should
> have already locked down a source gid entry and that should be where
> the sk really comes from??

You are exactly right on the architecture. Conceptually, the namespace 
and socket context should be strictly locked down via the source GID 
entry by the time we hit the provider routing path.

However, RXE currently relies on an internal, dummy kernel socket 
created per-netns to pass into ip6_dst_lookup_flow(). The 
rxe_ns_pernet_sk6(net) helper fetches this global socket on the fly.

This patch is a localized, tactical fix for an active Use-After-Free 
(UAF) crash. Without it, a concurrent container/netns teardown can free 
that dummy socket right in the middle of ip6_dst_lookup_flow(). The 
rxe_ns_lock and sock_hold() are just there to pin the socket's lifetime 
during the routing call.

I agree that structurally aligning RXE to derive/pin this context 
directly from the GID entry lifecycle would be the cleaner, long-term 
fix. For now, this patch unblocks the immediate crash.

Zhu Yanjun

> 
> Jason