From: Jason Gunthorpe <jgg@ziepe•ca>
To: David Ahern <dsahern@kernel•org>
Cc: Edward Adam Davis <eadavis@qq•com>,
akpm@linux-foundation•org, arjan@linux•intel.com,
davem@davemloft•net, edumazet@google•com, hdanton@sina•com,
horms@kernel•org, kuba@kernel•org, kuniyu@google•com,
leon@kernel•org, linux-kernel@vger•kernel.org,
linux-rdma@vger•kernel.org, netdev@vger•kernel.org,
pabeni@redhat•com,
syzbot+d8f76778263ab65c2b21@syzkaller•appspotmail.com,
syzkaller-bugs@googlegroups•com, yanjun.zhu@linux•dev,
zyjzyj2000@gmail•com
Subject: Re: [PATCH] RDMA/nldev: add mutual exclusion in nldev_dellink()
Date: Thu, 14 May 2026 11:14:09 -0300 [thread overview]
Message-ID: <20260514141409.GA7702@ziepe.ca> (raw)
In-Reply-To: <139794f1-80b8-49d9-829a-0629379def51@kernel.org>
On Thu, May 14, 2026 at 07:58:18AM -0600, David Ahern wrote:
> On 5/14/26 5:50 AM, Jason Gunthorpe wrote:
> > On Thu, May 14, 2026 at 03:31:22PM +0800, Edward Adam Davis wrote:
> >> On Wed, 13 May 2026 20:46:55 -0300, Jason Gunthorpe wrote:
> >>> On Wed, May 13, 2026 at 02:17:28PM -0400, Leon Romanovsky wrote:
> >>>>
> >>>> On Thu, 07 May 2026 20:50:10 +0800, Edward Adam Davis wrote:
> >>>>> We must serialize calls to nldev_dellink() or risk a crash as syzbot
> >>>>> reported:
> >>>>>
> >>>>> Call Trace:
> >>>>> udp_tunnel_sock_release+0x6d/0x80 net/ipv4/udp_tunnel_core.c:197
> >>>>> rxe_release_udp_tunnel drivers/infiniband/sw/rxe/rxe_net.c:294 [inline]
> >>>>> rxe_sock_put drivers/infiniband/sw/rxe/rxe_net.c:639 [inline]
> >>>>> rxe_net_del+0xfb/0x290 drivers/infiniband/sw/rxe/rxe_net.c:660
> >>>>> rxe_dellink+0x15/0x20 drivers/infiniband/sw/rxe/rxe.c:254
> >>>>>
> >>>>> [...]
> >>>>
> >>>> Applied, thanks!
> >>>>
> >>>> [1/1] RDMA/nldev: add mutual exclusion in nldev_dellink()
> >>>> https://git.kernel.org/rdma/rdma/c/0b28000b64f40d
> >>>
> >>> This seems like a rxe bug, I would have expected the lock to be inside
> >>> rxe to protect its racy implementation of rxe_net_del(), which looks
> >>> like it is possibly also triggered by NETDEV_UNREGISTER...
> >> No, it was triggered by RDMA_NLDEV_CMD_DELLINK, you can see the "call trace".
>
> Not that Jason's point. Code wise
>
> rxe_dellink -> rxe_net_del
>
> netdev NETDEV_UNREGISTER:
> rxe_notify -> rxe_net_del
>
> both can lead to the same problem
>
> >>>
> >>> ie it should not change nldev_dellink().
> >> While this could be fixed within RXE, the same issue affects all other
> >> RXE-like submodules when they subsequently support the "dellink" interface,
> >> therefore, handling this within nldev_dellink() is relatively more appropriate.
> >
> > Why would other modules have an issue? The problem is rxe's racey
> > refcounting scheme for its lazy socket creation. There is nothing
> > wrong with nldev, and now you've created some nasty BKL in the nldev
> > code to fix rxe while ignoring its other races.
>
> +1
Edward, please come with a fixup on top of this since it was already
applied
Jason
next prev parent reply other threads:[~2026-05-14 14:14 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-23 15:01 [syzbot] [net?] general protection fault in kernel_sock_shutdown (4) syzbot
2026-04-23 17:41 ` Jakub Kicinski
2026-04-24 16:47 ` Arjan van de Ven
2026-04-24 18:08 ` Arjan van de Ven
2026-05-06 13:48 ` [syzbot] [rdma] " syzbot
2026-05-06 14:28 ` Zhu Yanjun
2026-05-06 15:19 ` Kuniyuki Iwashima
2026-05-07 3:52 ` syzbot
2026-05-07 12:50 ` [PATCH] RDMA/nldev: add mutual exclusion in nldev_dellink() Edward Adam Davis
2026-05-07 13:25 ` Zhu Yanjun
2026-05-07 13:40 ` Edward Adam Davis
2026-05-07 14:11 ` Zhu Yanjun
2026-05-13 18:17 ` Leon Romanovsky
2026-05-13 23:46 ` Jason Gunthorpe
2026-05-14 7:31 ` Edward Adam Davis
2026-05-14 11:50 ` Jason Gunthorpe
2026-05-14 13:58 ` David Ahern
2026-05-14 14:14 ` Jason Gunthorpe [this message]
2026-05-14 14:26 ` David Ahern
2026-05-14 15:46 ` Zhu Yanjun
2026-05-16 12:40 ` Edward Adam Davis
2026-05-16 14:00 ` [PATCH RDMA v2] RDMA/rxe: add mutual exclusion in rxe_net_del() Edward Adam Davis
2026-05-16 14:31 ` Zhu Yanjun
2026-05-16 23:40 ` Yanjun.Zhu
2026-05-17 1:56 ` Edward Adam Davis
2026-05-17 2:15 ` Kuniyuki Iwashima
2026-05-17 3:27 ` Zhu Yanjun
2026-05-17 4:31 ` Zhu Yanjun
2026-05-14 5:15 ` [syzbot] [rdma] general protection fault in kernel_sock_shutdown (4) Zhu Yanjun
2026-05-16 5:44 ` Zhu Yanjun
2026-05-16 7:02 ` syzbot
2026-05-16 18:40 ` Zhu Yanjun
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260514141409.GA7702@ziepe.ca \
--to=jgg@ziepe$(echo .)ca \
--cc=akpm@linux-foundation$(echo .)org \
--cc=arjan@linux$(echo .)intel.com \
--cc=davem@davemloft$(echo .)net \
--cc=dsahern@kernel$(echo .)org \
--cc=eadavis@qq$(echo .)com \
--cc=edumazet@google$(echo .)com \
--cc=hdanton@sina$(echo .)com \
--cc=horms@kernel$(echo .)org \
--cc=kuba@kernel$(echo .)org \
--cc=kuniyu@google$(echo .)com \
--cc=leon@kernel$(echo .)org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-rdma@vger$(echo .)kernel.org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=syzbot+d8f76778263ab65c2b21@syzkaller$(echo .)appspotmail.com \
--cc=syzkaller-bugs@googlegroups$(echo .)com \
--cc=yanjun.zhu@linux$(echo .)dev \
--cc=zyjzyj2000@gmail$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox