Re: [PATCH rdma-next v3 02/14] RDMA/core: Handle device name conflicts when changing net namespace

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Skipping device_rename() during namespace teardown fallback leaves the sysfs kobject tagged with a dying namespace, leading to Use-After-Free.
--

--- Patch [2]: [PATCH rdma-next v3 02/14] RDMA/core: Handle device name conflicts when changing net namespace ---
commit 8e5328bda494a60bcfbc9c96c81fb95f503e0fdd
Author: Jiri Pirko <jiri@resnulli.us>

RDMA/core: Handle device name conflicts when changing net namespace
    
Prepare namespace moves for per-netns names. Check user-initiated moves for
destination-name conflicts before disabling the device, keep same-netns
moves as no-ops, and make teardown moves detach from the exiting namespace
even if fallback naming fails.

> diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
> index de610f52c9b23..b55fb075d0aef 100644
> --- a/drivers/infiniband/core/device.c
> +++ b/drivers/infiniband/core/device.c
[ ... ]
> @@ -1704,30 +1778,63 @@ static int rdma_dev_change_netns(struct ib_device *device, struct net *cur_net,
>  		goto out;
>  	}
>  
[ ... ]
>  	/*
> -	 * At this point no one can be using the device, so it is safe to
> -	 * change the namespace.
> +	 * Recompute the destination name under the write side of devices_rwsem
> +	 * now that the device is disabled, closing races with a concurrent
> +	 * registration or rename, then publish the new namespace at the sysfs
> +	 * level.
>  	 */
> -	write_pnet(&device->coredev.rdma_net, net);
> +	down_write(&devices_rwsem);
> +	ret = rdma_dev_pick_netns_name(device, net, fallback_pattern, buf,
> +				       sizeof(buf), &new_name);
> +	if (ret) {
> +		if (fallback_pattern) {
> +			WARN(1,
> +			     "%s: failed to pick device name during namespace teardown: %d\n",
> +			     __func__, ret);
> +			write_pnet(&device->coredev.rdma_net, net);
> +			ret = 0;
> +		}
> +		goto rename_done;
> +	}
>  
> -	down_read(&devices_rwsem);
> -	/*
> -	 * Currently rdma devices are system wide unique. So the device name
> -	 * is guaranteed free in the new namespace. Publish the new namespace
> -	 * at the sysfs level.
> -	 */
> -	ret = device_rename(&device->dev, dev_name(&device->dev));
> -	up_read(&devices_rwsem);
> +	write_pnet(&device->coredev.rdma_net, net);
> +	ret = device_rename(&device->dev, new_name);
>  	if (ret) {
> -		dev_warn(&device->dev,
> -			 "%s: Couldn't rename device after namespace change\n",
> -			 __func__);
> -		/* Try and put things back and re-enable the device */
> -		write_pnet(&device->coredev.rdma_net, cur_net);
> +		if (fallback_pattern) {
> +			WARN(1,
> +			     "%s: failed to rename device during namespace teardown: %d\n",
> +			     __func__, ret);
> +			ret = 0;
> +		} else {

[Severity: High]
This isn't a bug introduced by this patch, but does skipping device_rename()
during namespace teardown fallback leave the sysfs kobject tagged with a dying
namespace?

If rdma_dev_pick_netns_name() fails and the code jumps to rename_done, or if
device_rename() fails and the error is suppressed by setting ret = 0, the
kernfs_node->ns tag for the device's sysfs directory would appear to remain
pointing to the dying network namespace.

Once the network namespace is freed, couldn't a subsequent sysfs traversal or
lookup calling kernfs_ns_id(kn->ns) dereference the freed pointer and result
in a use-after-free?

> +			dev_warn(&device->dev,
> +				 "%s: Couldn't rename device after namespace change\n",
> +				 __func__);
> +			/* Try and put things back and re-enable the device */
> +			write_pnet(&device->coredev.rdma_net, cur_net);
> +		}
> +	} else {
> +		strscpy(device->name, dev_name(&device->dev),
> +			IB_DEVICE_NAME_MAX);
>  	}
> +rename_done:
> +	up_write(&devices_rwsem);
>  
>  	ret2 = enable_device_and_get(device);
>  	if (ret2) {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260716132316.1495242-1-jiri@resnulli.us?part=2