Linux s390 Architecture development
 help / color / mirror / Atom feed
From: Jiri Pirko <jiri@resnulli.us>
To: sashiko-reviews@lists.linux.dev
Cc: tj@kernel.org, hannes@cmpxchg.org, mkoutny@suse.com,
	 linux-s390@vger.kernel.org, Heiko Carstens <hca@linux.ibm.com>,
	 Vasily Gorbik <gor@linux.ibm.com>,
	Alexander Gordeev <agordeev@linux.ibm.com>
Subject: Re: [PATCH rdma-next v2 06/14] net/smc: Look up the pnetid ib device within the net namespace
Date: Thu, 16 Jul 2026 09:19:20 +0200	[thread overview]
Message-ID: <aliF6MhKWL_iilRP@FV6GYCPJ69> (raw)
In-Reply-To: <20260715143043.4F3CC1F00A3A@smtp.kernel.org>

Wed, Jul 15, 2026 at 04:30:42PM +0200, sashiko-bot@kernel.org wrote:
>Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>
>Pre-existing issues:
>- [High] Returning unreferenced device pointers from `smc_pnet_find_ib()` and `smc_pnet_find_smcd()` causes Use-After-Free vulnerabilities when devices are concurrently removed.
>--
>
>--- Patch [6]: [PATCH rdma-next v2 06/14] net/smc: Look up the pnetid ib device within the net namespace ---
>commit 4529cf06709604767797679d2d489bb89001f950
>Author: Jiri Pirko <jiri@nvidia.com>
>Date:   Tue Jul 14 14:29:19 2026 +0000
>
>    net/smc: Look up the pnetid ib device within the net namespace
>    
>    Scope smc_pnet_find_ib() to the caller's net namespace so pnetid setup
>    cannot bind to a same-named RDMA device from another namespace once names
>    become per-netns.
>
>> diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c
>> index 63e286e2dfaa8..ff9c9c35cc2f5 100644
>> --- a/net/smc/smc_pnet.c
>> +++ b/net/smc/smc_pnet.c
>> @@ -408,8 +413,8 @@ static int smc_pnet_add_eth(struct smc_pnettable *pnettable, struct net *net,
>>  	return rc;
>>  }
>>  
>> -static int smc_pnet_add_ib(struct smc_pnettable *pnettable, char *ib_name,
>> -			   u8 ib_port, char *pnet_name)
>> +static int smc_pnet_add_ib(struct smc_pnettable *pnettable, struct net *net,
>> +			   char *ib_name, u8 ib_port, char *pnet_name)
>>  {
>>  	struct smc_pnetentry *tmp_pe, *new_pe;
>>  	struct smc_ib_device *ib_dev;
>> @@ -419,7 +424,7 @@ static int smc_pnet_add_ib(struct smc_pnettable *pnettable, char *ib_name,
>>  	bool new_ibdev;
>>  
>>  	/* try to apply the pnetid to active devices */
>> -	ib_dev = smc_pnet_find_ib(ib_name);
>> +	ib_dev = smc_pnet_find_ib(net, ib_name);
>
>[Severity: High]
>This is a pre-existing issue, but can this lead to a use-after-free?

Unrelated to this patch/set. Ignoring.

  reply	other threads:[~2026-07-16  7:19 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-14 14:29 [PATCH rdma-next v2 00/14] RDMA: Make device names unique per net namespace Jiri Pirko
2026-07-14 14:29 ` [PATCH rdma-next v2 01/14] RDMA/core: Pass the net namespace to the device name lookups Jiri Pirko
2026-07-14 14:29 ` [PATCH rdma-next v2 02/14] RDMA/core: Handle device name conflicts when changing net namespace Jiri Pirko
2026-07-14 14:29 ` [PATCH rdma-next v2 03/14] RDMA/core: Support renaming a device when changing its " Jiri Pirko
2026-07-15 14:30   ` sashiko-bot
2026-07-16  7:18     ` Jiri Pirko
2026-07-14 14:29 ` [PATCH rdma-next v2 04/14] RDMA/nldev: Report net namespace move errors through extack Jiri Pirko
2026-07-14 14:29 ` [PATCH rdma-next v2 05/14] RDMA/nldev: Allow setting the device name while changing net namespace Jiri Pirko
2026-07-14 14:29 ` [PATCH rdma-next v2 06/14] net/smc: Look up the pnetid ib device within the " Jiri Pirko
2026-07-15 14:30   ` sashiko-bot
2026-07-16  7:19     ` Jiri Pirko [this message]
2026-07-14 14:29 ` [PATCH rdma-next v2 07/14] RDMA/srp: Make the SRP sysfs class net namespace aware Jiri Pirko
2026-07-14 14:29 ` [PATCH rdma-next v2 08/14] RDMA/cgroup: Disambiguate devices across net namespaces Jiri Pirko
2026-07-14 14:29 ` [PATCH rdma-next v2 09/14] RDMA/cma: Document that CM configfs cannot be net namespace scoped Jiri Pirko
2026-07-14 14:29 ` [PATCH rdma-next v2 10/14] RDMA/core: Document the SELinux ibendport net namespace limitation Jiri Pirko
2026-07-14 14:29 ` [PATCH rdma-next v2 11/14] RDMA/core: Make device names unique per net namespace Jiri Pirko
2026-07-15 14:30   ` sashiko-bot
2026-07-16  7:18     ` Jiri Pirko
2026-07-14 14:29 ` [PATCH rdma-next v2 12/14] RDMA/rxe: Allow queue VMAs to outlive ucontexts Jiri Pirko
2026-07-14 14:29 ` [PATCH rdma-next v2 13/14] RDMA/rxe: Implement disassociate_ucontext callback Jiri Pirko
2026-07-14 14:29 ` [PATCH rdma-next v2 14/14] RDMA/selftests: Add rxe_netns_names test Jiri Pirko
2026-07-15 14:30   ` sashiko-bot
2026-07-16 10:30     ` Jiri Pirko

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=aliF6MhKWL_iilRP@FV6GYCPJ69 \
    --to=jiri@resnulli.us \
    --cc=agordeev@linux.ibm.com \
    --cc=gor@linux.ibm.com \
    --cc=hannes@cmpxchg.org \
    --cc=hca@linux.ibm.com \
    --cc=linux-s390@vger.kernel.org \
    --cc=mkoutny@suse.com \
    --cc=sashiko-reviews@lists.linux.dev \
    --cc=tj@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox