Re: [PATCH rdma-next 02/13] RDMA/core: Handle device name conflicts when changing net namespace

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] User-triggerable WARN() during concurrent RDMA device unregistration and netns exit, leading to DoS on panic_on_warn systems.
--

--- Patch [2]: [PATCH rdma-next 02/13] RDMA/core: Handle device name conflicts when changing net namespace ---
commit 05c3f87e2143d43f2f1e27d0f13e1b1f97f35bab
Author: Jiri Pirko <jiri@nvidia.com>

RDMA/core: Handle device name conflicts when changing net namespace

This commit prepares namespace moves for per-netns names by checking
user-initiated moves for destination-name conflicts before disabling the
device. It also ensures teardown moves detach from the exiting namespace
even if fallback naming fails.

> diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
> --- a/drivers/infiniband/core/device.c
> +++ b/drivers/infiniband/core/device.c
> @@ -1160,8 +1168,17 @@ static void rdma_dev_exit_net(struct net *net)
>  
>  		/*
>  		 * If the real device is in the NS then move it back to init.
> +		 * Provide a fallback pattern so a name conflict in init_net
> +		 * cannot make the teardown move fail.
>  		 */
> -		rdma_dev_change_netns(dev, net, &init_net);
> +		if (net_eq(net, read_pnet(&dev->coredev.rdma_net))) {
> +			ret = rdma_dev_change_netns(dev, net, &init_net,
> +						    "ibdev%d");
> +			if (ret)
> +				WARN(1,
> +				     "Failed to move RDMA device %s to init_net on netns exit: %d\n",
> +				     dev_name(&dev->dev), ret);

[Severity: High]
Can this WARN(1) be triggered by a concurrent device unregistration?

Looking at rdma_dev_change_netns(), if a device is concurrently unregistered,
the refcount drops to 0 and the function legitimately returns -ENODEV:

drivers/infiniband/core/device.c:rdma_dev_change_netns() {
    ...
    if (refcount_read(&device->refcount) == 0 ||
        !net_eq(cur_net, read_pnet(&device->coredev.rdma_net))) {
            ret = -ENODEV;
            goto out;
    }
    ...
}

If rdma_dev_exit_net() runs concurrently with device unregistration (e.g.,
module unload, PCI hotplug, or link deletion of a software RDMA device like
RXE), rdma_dev_change_netns() will return -ENODEV and trigger this warning.

Because an unprivileged user can acquire CAP_NET_ADMIN in a user namespace,
create an RXE device, and race netns deletion with device deletion, could
this be used to intentionally crash a host configured with panic_on_warn=1?

> +		}
>  
>  		put_device(&dev->dev);
>  		down_read(&devices_rwsem);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709095532.855647-1-jiri@resnulli.us?part=2