Re: [PATCH v1] RDMA/rxe: unpublish the per-net tunnel socket before

[Leon Romanovsky]

On Wed, 23 Sep 2026 13:18:00 +0800, Binbin Deng wrote:
> KASAN reports a slab-use-after-free in ip6_route_output_flags()
> reached from rxe_find_route(), with the free in __sk_destruct() after
> rxe_sock_put(), and a user with CAP_NET_ADMIN can remove the device with
> "rdma link del rxe0" while RoCE v2 over IPv6 traffic keeps looking the
> socket up.
> 
> BUG: KASAN: slab-use-after-free in ip6_route_output_flags+0x300/0x360
> Read of size 4 at addr ffff888115ddd794 by task kworker/u32:6/309
> Call Trace:
>  <TASK>
>  dump_stack_lvl+0x53/0x70
>  print_report+0xd0/0x630
>  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
>  ? ip6_route_output_flags+0x300/0x360
>  kasan_report+0xce/0x100
>  ? ip6_route_output_flags+0x300/0x360
>  ip6_route_output_flags+0x300/0x360
>  ip6_dst_lookup_tail.constprop.0+0x76c/0xcc0
>  ? ct_nmi_exit+0xc3/0xf0
>  ip6_dst_lookup_flow+0xf5/0x1e0
>  ? __pfx_ip6_dst_lookup_flow+0x10/0x10
>  rxe_find_route+0x426/0xa30
>  ? __kasan_slab_alloc+0x6e/0x70
>  ? __pfx_rxe_find_route+0x10/0x10
>  ? kmem_cache_alloc_node_noprof+0x141/0x370
>  ? kmalloc_reserve+0x103/0x2b0
>  ? rxe_icrc_generate+0x229/0x330
>  ? __pfx___alloc_skb+0x10/0x10
>  rxe_prepare+0x9e8/0x18b0
>  ? rxe_init_packet+0x3c7/0x4f0
>  rxe_requester+0x1a0f/0x51f0
>  ? rxe_completer+0x1de9/0x38c0
>  ? __pfx_rxe_completer+0x10/0x10
>  ? __queue_work+0x43e/0x11f0
>  ? __pfx_rxe_requester+0x10/0x10
>  ? irqentry_exit+0xd2/0x640
>  ? _raw_spin_lock_irqsave+0x85/0xe0
>  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
>  ? __pfx_rxe_sender+0x10/0x10
>  rxe_sender+0xe/0x30
>  do_work+0x144/0x470
>  process_one_work+0x633/0x1030
>  ? assign_work+0x11d/0x370
>  worker_thread+0x45b/0xd10
>  ? __pfx_worker_thread+0x10/0x10
>  kthread+0x2c6/0x3b0
>  ? recalc_sigpending+0x15c/0x1e0
>  ? __pfx_kthread+0x10/0x10
>  ret_from_fork+0x36e/0x5a0
>  ? __pfx_ret_from_fork+0x10/0x10
>  ? __switch_to+0x572/0xdd0
>  ? __pfx_kthread+0x10/0x10
>  ret_from_fork_asm+0x1a/0x30
>  </TASK>
> 
> [...]

Applied, thanks!

[1/1] RDMA/rxe: unpublish the per-net tunnel socket before
      https://git.kernel.org/rdma/rdma/c/4af07308d8227a

Best regards,
-- 
Leon Romanovsky <leon@xxxxxxxxxx>