Re: [PATCH rdma-next 02/13] RDMA/core: Handle device name conflicts when changing net namespace

[Jiri Pirko <jiri@resnulli.us>]

Fri, Jul 10, 2026 at 11:56:27AM +0200, sashiko-bot@kernel.org wrote:
>Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>- [High] User-triggerable WARN() during concurrent RDMA device unregistration and netns exit, leading to DoS on panic_on_warn systems.
>--
>
>--- Patch [2]: [PATCH rdma-next 02/13] RDMA/core: Handle device name conflicts when changing net namespace ---
>commit 05c3f87e2143d43f2f1e27d0f13e1b1f97f35bab
>Author: Jiri Pirko <jiri@nvidia.com>
>
>RDMA/core: Handle device name conflicts when changing net namespace
>
>This commit prepares namespace moves for per-netns names by checking
>user-initiated moves for destination-name conflicts before disabling the
>device. It also ensures teardown moves detach from the exiting namespace
>even if fallback naming fails.
>
>> diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
>> --- a/drivers/infiniband/core/device.c
>> +++ b/drivers/infiniband/core/device.c
>> @@ -1160,8 +1168,17 @@ static void rdma_dev_exit_net(struct net *net)
>>  
>>  		/*
>>  		 * If the real device is in the NS then move it back to init.
>> +		 * Provide a fallback pattern so a name conflict in init_net
>> +		 * cannot make the teardown move fail.
>>  		 */
>> -		rdma_dev_change_netns(dev, net, &init_net);
>> +		if (net_eq(net, read_pnet(&dev->coredev.rdma_net))) {
>> +			ret = rdma_dev_change_netns(dev, net, &init_net,
>> +						    "ibdev%d");
>> +			if (ret)
>> +				WARN(1,
>> +				     "Failed to move RDMA device %s to init_net on netns exit: %d\n",
>> +				     dev_name(&dev->dev), ret);
>
>[Severity: High]
>Can this WARN(1) be triggered by a concurrent device unregistration?
>
>Looking at rdma_dev_change_netns(), if a device is concurrently unregistered,
>the refcount drops to 0 and the function legitimately returns -ENODEV:
>
>drivers/infiniband/core/device.c:rdma_dev_change_netns() {
>    ...
>    if (refcount_read(&device->refcount) == 0 ||
>        !net_eq(cur_net, read_pnet(&device->coredev.rdma_net))) {
>            ret = -ENODEV;
>            goto out;
>    }
>    ...
>}
>
>If rdma_dev_exit_net() runs concurrently with device unregistration (e.g.,
>module unload, PCI hotplug, or link deletion of a software RDMA device like
>RXE), rdma_dev_change_netns() will return -ENODEV and trigger this warning.
>
>Because an unprivileged user can acquire CAP_NET_ADMIN in a user namespace,
>create an RXE device, and race netns deletion with device deletion, could
>this be used to intentionally crash a host configured with panic_on_warn=1?

Fixed.


>
>> +		}
>>  
>>  		put_device(&dev->dev);
>>  		down_read(&devices_rwsem);
>
>-- 
>Sashiko AI review · https://sashiko.dev/#/patchset/20260709095532.855647-1-jiri@resnulli.us?part=2