[PATCH] RDMA/rxe: fix UDP tunnel socket leak on rxe_newlink failure

[Purushothaman Ramalingam]

rxe_newlink() calls rxe_net_init() to set up the per-net-namespace UDP
tunnel sockets before calling rxe_net_add() to create and register the
rxe device. rxe_net_init() takes a reference on the IPv4 and IPv6 tunnel
sockets, creating them if they do not already exist.

If rxe_net_add() subsequently fails, rxe_newlink() returns the error
without releasing those socket references. The normal teardown path,
rxe_net_del(), is never reached because rxe_net_add() has already
deallocated the rxe device on failure. As a result the tunnel socket
references are leaked and the per-net sockets bound to UDP port 4791 can
never be released.

Release the references on the error path by adding rxe_net_uninit(),
which performs the same socket teardown as rxe_net_del(). The shared
release logic is factored into a helper to avoid duplication.

Fixes: f1327abd6abe ("RDMA/rxe: Support RDMA link creation and destruction per net namespace")
Signed-off-by: Purushothaman Ramalingam <purush.ramalingam@xxxxxxxxx>
---
 drivers/infiniband/sw/rxe/rxe.c     |  1 +
 drivers/infiniband/sw/rxe/rxe_net.c | 32 ++++++++++++++++++++---------
 drivers/infiniband/sw/rxe/rxe_net.h |  1 +
 3 files changed, 24 insertions(+), 10 deletions(-)

diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c
index af39209d0fcf..bcc72b96ee00 100644
--- a/drivers/infiniband/sw/rxe/rxe.c
+++ b/drivers/infiniband/sw/rxe/rxe.c
@@ -243,6 +243,7 @@ static int rxe_newlink(const char *ibdev_name, struct net_device *ndev)
 	err = rxe_net_add(ibdev_name, ndev);
 	if (err) {
 		rxe_err("failed to add %s\n", ndev->name);
+		rxe_net_uninit(ndev);
 		goto err;
 	}
 err:
diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
index 50a2cb5405e2..b98f66099dea 100644
--- a/drivers/infiniband/sw/rxe/rxe_net.c
+++ b/drivers/infiniband/sw/rxe/rxe_net.c
@@ -642,18 +642,10 @@ static void rxe_sock_put(struct sock *sk,
 	}
 }
 
-void rxe_net_del(struct ib_device *dev)
+/* release the per-net-namespace tunnel socket references held for @net */
+static void rxe_release_sockets(struct net *net)
 {
-	struct rxe_dev *rxe = container_of(dev, struct rxe_dev, ib_dev);
-	struct net_device *ndev;
 	struct sock *sk;
-	struct net *net;
-
-	ndev = rxe_ib_device_get_netdev(&rxe->ib_dev);
-	if (!ndev)
-		return;
-
-	net = dev_net(ndev);
 
 	sk = rxe_ns_pernet_sk4(net);
 	if (sk)
@@ -662,6 +654,26 @@ void rxe_net_del(struct ib_device *dev)
 	sk = rxe_ns_pernet_sk6(net);
 	if (sk)
 		rxe_sock_put(sk, rxe_ns_pernet_set_sk6, net);
+}
+
+/* release the socket references taken by a successful rxe_net_init() when a
+ * later step of device creation fails and rxe_net_del() will not be called
+ */
+void rxe_net_uninit(struct net_device *ndev)
+{
+	rxe_release_sockets(dev_net(ndev));
+}
+
+void rxe_net_del(struct ib_device *dev)
+{
+	struct rxe_dev *rxe = container_of(dev, struct rxe_dev, ib_dev);
+	struct net_device *ndev;
+
+	ndev = rxe_ib_device_get_netdev(&rxe->ib_dev);
+	if (!ndev)
+		return;
+
+	rxe_release_sockets(dev_net(ndev));
 
 	dev_put(ndev);
 }
diff --git a/drivers/infiniband/sw/rxe/rxe_net.h b/drivers/infiniband/sw/rxe/rxe_net.h
index 56249677d692..d55aacce2905 100644
--- a/drivers/infiniband/sw/rxe/rxe_net.h
+++ b/drivers/infiniband/sw/rxe/rxe_net.h
@@ -16,6 +16,7 @@ void rxe_net_del(struct ib_device *dev);
 
 int rxe_register_notifier(void);
 int rxe_net_init(struct net_device *ndev);
+void rxe_net_uninit(struct net_device *ndev);
 void rxe_net_exit(void);
 
 #endif /* RXE_NET_H */
-- 
2.53.0