Re: [PATCH v3] RDMA/rxe: rework per-net tunnel socket lifetime to fix refcount underflow

[Zhu Yanjun]

在 2026/7/8 11:10, Serhat Kumral 写道:
> Hi Yanjun,
>
> > However, after the network namespace teardown, the associated netdevice
> > is still unregistered, which
> > triggers the NETDEV_UNREGISTER notifier. In rxe_notify(), this event
> > eventually calls rxe_net_del() to
> > remove the RDMA link.
> Isn't the ordering the other way around? The netdevices of a dying
> netns are unregistered by default_device_exit_batch(), a pernet
> device op, while rxe_net_ops is a pernet subsys, and subsys exits
> run after all device exits. So NETDEV_UNREGISTER (and the notifier's
> rxe_net_del()) should have already completed before rxe_ns_exit()
> destroys the mutex.
>
> Am I missing a path where rxe_net_del() can run after rxe_ns_exit()?

Hi,

Thanks for the clarification. Your analysis is spot on.

The assumption that pernet device exit (default_device_exit_batch)
always guarantees a synchronous NETDEV_UNREGISTER notification for all
netdevices prior to pernet subsys exit (rxe_ns_exit) is indeed flawed.

There are two critical blind spots in this flow:

Netns Migration (The init_net fallback): During netns teardown, certain 
stateful or persistent devices like loopback
(lo) or stacked virtual interfaces are moved back to init_net via
dev_change_net_namespace() rather than being fully unregistered. This
triggers NETDEV_DOWN or namespace change events instead of a standard
NETDEV_UNREGISTER. Consequently, rxe_net_del() is skipped, leaving
stale RXE resources bound to the dying netns.

Module Unload Race (Parallel Cleanup): When rmmod rdma_rxe invokes 
unregister_pernet_subsys(), rxe_ns_exit()
runs concurrently across multiple netns. If a concurrent thread or a
deferred RCU/workqueue task (e.g., net_todo_list) is simultaneously
processing an asynchronous netdevice unregistration, rxe_net_del() and
rxe_ns_exit() will race on different CPUs.

In both corner cases, rxe_ns_exit() can proceed to tear down the pernet
infrastructure and destroy the mutex lock while a lingering
or concurrent rxe_net_del() invocation still attempts to acquire it.
This inevitably triggers a Use-After-Free (UAF) on the mutex.

To fix this properly, we must ensure that:

rxe_ns_exit() explicitly flushes and tears down any remaining RXE
devices under the lock before the mutex is destroyed.

We handle netns migration events properly in the netdev notifier to
trigger early cleanup.

Could you please a new patch to include this explicit ordering in
rxe_ns_exit()?

Thanks a lot.

Zhu Yanjun

> Thanks,
> Serhat

--
Best Regards,
Yanjun.Zhu