Re: [PATCH rdma-next 12/13] RDMA/rxe: Implement disassociate_ucontext callback

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Implementing an empty `disassociate_ucontext` callback bypasses the core's VMA zapping because RXE uses legacy, untracked VMAs. This leads to a Use-After-Free of `ib_ucontext` and `rxe_dev` when the VMA is eventually closed, and potential kernel panics upon module unload.
--

--- Patch [12]: [PATCH rdma-next 12/13] RDMA/rxe: Implement disassociate_ucontext callback ---
commit 8946fc9f2a378bad6f910a408699c6a70e97a6f6
Author: Jiri Pirko <jiri@resnulli.us>

RDMA/rxe: Implement disassociate_ucontext callback

Implement an empty disassociate_ucontext() callback so the RDMA core
can move rxe devices between net namespaces. The core requires this
callback to reset user contexts without waiting for userspace.

> diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
> index 1ec130fee8ea7..6eb10d2f0653b 100644
> --- a/drivers/infiniband/sw/rxe/rxe_verbs.c
> +++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
> @@ -240,6 +240,10 @@ static void rxe_dealloc_ucontext(struct ib_ucontext *ibuc)
>  		rxe_err_uc(uc, "cleanup failed, err = %d\n", err);
>  }
>  
> +static void rxe_disassociate_ucontext(struct ib_ucontext *ibuc)
> +{
> +}
> +

[Severity: Critical]
By adding this callback, does this opt the driver into asynchronous teardown
which can lead to a use-after-free and kernel panic?

Because RXE uses legacy, untracked VMAs (bypassing the core's
rdma_user_mmap_entry mechanism), these VMAs are invisible to the core and are
not zapped during teardown.

If a user process maps an RXE resource and the device is then removed or
migrated to another network namespace, the asynchronous teardown will free
the ib_ucontext and allow module unload while the process still holds the VMA.

When the process later unmaps the memory or exits, the untracked VMA's close
callback (rxe_vma_close) will trigger rxe_mmap_release(), accessing the
already-freed ib_ucontext and rxe_dev:

drivers/infiniband/sw/rxe/rxe_mmap.c:rxe_mmap_release() {
	struct rxe_mmap_info *ip = container_of(ref,
					struct rxe_mmap_info, ref);
	struct rxe_dev *rxe = to_rdev(ip->context->device);

	spin_lock_bh(&rxe->pending_lock);
    ...
}

If the module was unloaded in the interim, jumping to the VMA's close callback
could also trigger an immediate kernel panic.

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709095532.855647-1-jiri@resnulli.us?part=12