Re: [PATCH v2] RDMA/rxe: rework per-net tunnel socket lifetime to fix refcount underflow

[Serhat Kumral]

Hi Yanjun,

> The current ordering introduces a subtle race that
> can leave an RXE link in an unrecoverable state.
>
> If the DELLINK path sets RXE_NET_SK_PUT first and
> then finds ndev == NULL, it returns without calling rxe_net_uninit().
>
> Finally, the per-netns UDP socket reference (nr_sk4/nr_sk6) is never
> decremented.

You are right, thanks for catching this. The once-only bit must not be
consumed by a path that can then fail to do the actual put.

In v3 the put no longer depends on ib_device_get_netdev() at all: the
struct net pointer is recorded in struct rxe_dev at creation time and
used for the put directly. That way the invocation that wins the
test_and_set_bit() can never fail to drop the references, even if the
queued unregister has already cleared the ib_device -> netdev
association. I chose this over reordering the bit test against the
netdev lookup because a reordered lookup still has a smaller window
where both racing paths see a NULL netdev.

I will send v3 shortly.

Thanks,
Serhat