Re: [PATCH rdma-next v3 02/14] RDMA/core: Handle device name conflicts when changing net namespace

[Jiri Pirko <jiri@resnulli.us>]

Fri, Jul 17, 2026 at 03:24:24PM +0200, sashiko-bot@kernel.org wrote:
>Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>
>Pre-existing issues:
>- [High] Skipping device_rename() during namespace teardown fallback leaves the sysfs kobject tagged with a dying namespace, leading to Use-After-Free.
>--
>
>--- Patch [2]: [PATCH rdma-next v3 02/14] RDMA/core: Handle device name conflicts when changing net namespace ---
>commit 8e5328bda494a60bcfbc9c96c81fb95f503e0fdd
>Author: Jiri Pirko <jiri@resnulli.us>
>
>RDMA/core: Handle device name conflicts when changing net namespace
>    
>Prepare namespace moves for per-netns names. Check user-initiated moves for
>destination-name conflicts before disabling the device, keep same-netns
>moves as no-ops, and make teardown moves detach from the exiting namespace
>even if fallback naming fails.
>
>> diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
>> index de610f52c9b23..b55fb075d0aef 100644
>> --- a/drivers/infiniband/core/device.c
>> +++ b/drivers/infiniband/core/device.c
>[ ... ]
>> @@ -1704,30 +1778,63 @@ static int rdma_dev_change_netns(struct ib_device *device, struct net *cur_net,
>>  		goto out;
>>  	}
>>  
>[ ... ]
>>  	/*
>> -	 * At this point no one can be using the device, so it is safe to
>> -	 * change the namespace.
>> +	 * Recompute the destination name under the write side of devices_rwsem
>> +	 * now that the device is disabled, closing races with a concurrent
>> +	 * registration or rename, then publish the new namespace at the sysfs
>> +	 * level.
>>  	 */
>> -	write_pnet(&device->coredev.rdma_net, net);
>> +	down_write(&devices_rwsem);
>> +	ret = rdma_dev_pick_netns_name(device, net, fallback_pattern, buf,
>> +				       sizeof(buf), &new_name);
>> +	if (ret) {
>> +		if (fallback_pattern) {
>> +			WARN(1,
>> +			     "%s: failed to pick device name during namespace teardown: %d\n",
>> +			     __func__, ret);
>> +			write_pnet(&device->coredev.rdma_net, net);
>> +			ret = 0;
>> +		}
>> +		goto rename_done;
>> +	}
>>  
>> -	down_read(&devices_rwsem);
>> -	/*
>> -	 * Currently rdma devices are system wide unique. So the device name
>> -	 * is guaranteed free in the new namespace. Publish the new namespace
>> -	 * at the sysfs level.
>> -	 */
>> -	ret = device_rename(&device->dev, dev_name(&device->dev));
>> -	up_read(&devices_rwsem);
>> +	write_pnet(&device->coredev.rdma_net, net);
>> +	ret = device_rename(&device->dev, new_name);
>>  	if (ret) {
>> -		dev_warn(&device->dev,
>> -			 "%s: Couldn't rename device after namespace change\n",
>> -			 __func__);
>> -		/* Try and put things back and re-enable the device */
>> -		write_pnet(&device->coredev.rdma_net, cur_net);
>> +		if (fallback_pattern) {
>> +			WARN(1,
>> +			     "%s: failed to rename device during namespace teardown: %d\n",
>> +			     __func__, ret);
>> +			ret = 0;
>> +		} else {
>
>[Severity: High]
>This isn't a bug introduced by this patch, but does skipping device_rename()
>during namespace teardown fallback leave the sysfs kobject tagged with a dying
>namespace?
>
>If rdma_dev_pick_netns_name() fails and the code jumps to rename_done, or if
>device_rename() fails and the error is suppressed by setting ret = 0, the
>kernfs_node->ns tag for the device's sysfs directory would appear to remain
>pointing to the dying network namespace.
>
>Once the network namespace is freed, couldn't a subsequent sysfs traversal or
>lookup calling kernfs_ns_id(kn->ns) dereference the freed pointer and result
>in a use-after-free?

unrelated to this patch/set. Ignoring.


>
>> +			dev_warn(&device->dev,
>> +				 "%s: Couldn't rename device after namespace change\n",
>> +				 __func__);
>> +			/* Try and put things back and re-enable the device */
>> +			write_pnet(&device->coredev.rdma_net, cur_net);
>> +		}
>> +	} else {
>> +		strscpy(device->name, dev_name(&device->dev),
>> +			IB_DEVICE_NAME_MAX);
>>  	}
>> +rename_done:
>> +	up_write(&devices_rwsem);
>>  
>>  	ret2 = enable_device_and_get(device);
>>  	if (ret2) {
>
>-- 
>Sashiko AI review · https://sashiko.dev/#/patchset/20260716132316.1495242-1-jiri@resnulli.us?part=2