From nobody Mon Jun 8 09:49:06 2026 Received: from mail-oi1-f178.google.com (mail-oi1-f178.google.com [209.85.167.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8FFBA42AA9 for ; Sat, 30 May 2026 00:14:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780100088; cv=none; b=GImaCcIKkJ2LZ1ey2t45lHCdSH+PrbJV+M1PTMwqtR5vj6vtcmAOEAEyu4RjS3hLg1EtY1WLKBzOPV2xB4x1aybqVKjHv3OvNsBhrzA0P9Vt0qk1Zg0+LqyRFAjpnUo7vrZCvXWuY8aMov2Vpt2ZdCuFNWiXkgunqp3dWoud77c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780100088; c=relaxed/simple; bh=uNKQJ6I+65vk9eSMhn800ZAbT1bZnwnHgdAp9iA9rWc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=rcsEy0FkCMAZ3fcvEf19DMiJyOng4e/fMGTa8wXV99XGWRS92TKtIs/Oxk7YGmuTzfuZtVKTWOcoCBm/3o9fPVnpF7Feo9o97xorW9WfZ556JiOVBrCEJpxZ/0/lj8S+5nh9A25I0OF2epX8OdNBatZJt0k9Ig64X7IQa7v4H3E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Z2r4K0dX; arc=none smtp.client-ip=209.85.167.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Z2r4K0dX" Received: by mail-oi1-f178.google.com with SMTP id 5614622812f47-479fc1fc048so10293393b6e.1 for ; Fri, 29 May 2026 17:14:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780100086; x=1780704886; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=kgPte3THu4lgDNo+Mz00fPQ8ki83JRI+Ap5FBqVI8rs=; b=Z2r4K0dXRen0JVYtu73n1WEIaq/l3xdi91eBpPMDBaofs5LarIZA7za2hCxV/98cm8 QeTz3qylb+WDKY4+xBHJMgITbLF8xa0j4a4QgsojcvQZBPsTJFzsrORWW19GYk4YYzkg 8+S3bvXU9ZCoRddS8kcT3DAwNVu3qY5eSqX3dRMG8V3h3OZc1EroxkY07Qi8uBLhATgO n0U0eZrzt2sF9DQnEv6osKaaZf47JmZ0DWN9vlxdz/aTBqTywvQbyC3WBbIGFWeHWsrN GeXa/lPcmdW9YXwdLj8z4/wekwYWVet5i8RMgqdsCL35EURiOtYRZw4XVrSBXANrBwVk gbFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780100086; x=1780704886; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=kgPte3THu4lgDNo+Mz00fPQ8ki83JRI+Ap5FBqVI8rs=; b=ERg13BWRbz/qArJYG8cRFjDZkQrGW3/OBvTecsq5Sabg1egiJ3i29NqooHK/RjSimO PLB/T9UCRYZl3GRd/VcVvqZMn1qQ/kV7PxvBaeNyC9SUOteHyiIq67iKcKgFheQkT6lG FUTjC25ynuoZ5DLWHkibSUZSQyLoqZjr+5z8fmHIwULzduFI5DEupg0x+gBZaxFKwTH+ 1VjD1m6jMo9C+Vw2LEmShAj7X3B1U0v4WyVv8Qzj1dzwHMOt2f/0/L0v+Xd5ey/PcT4n 9HfWDuFf/YiQC608lVeepZF7wfxgyhpX5NAWkpWgOOIXklc2YVA14VzC4fFsFaL6M7xx 0l9w== X-Forwarded-Encrypted: i=1; AFNElJ+ZpSjYeCB0RlafALeEl9NThsUT9mR0jQ4yNkrmsNqKcyxfyEJlxWt9jTwK/gG+usFCJRxzZUW9uRmcEDs=@vger.kernel.org X-Gm-Message-State: AOJu0YzhjE3/gPjJP7R2t690g4pFkI5fPMNYdlesgbK5ZTsjgkEXLQpp 75ii8kU6oU8Rsw3Me9sOkpzqRA+JSaMBsPsIbTTOu2QwYcaqBVUp0fUaqgevAtVL X-Gm-Gg: Acq92OHFUZIKZbbGlC0uT6LT1korObXUwb6jEg6LZPOrAVVAZ33ziY2NRmZ5Bdfx50Q RdPGF0KznNz3McnSuxJbe+h3De2avjYR2jBr0t5ugUDb/DAj+L2UwuHB1gGPMb6uRrObF8HzPzS MCUZqRyfhnqatTlqhswBkkk4qmLQSvOIJi7l4Xpm2cmBw2aJT8rg/t8ZN2uJvyjeKpHWRXercnK HtT9UWhnd4FNDYe/qlh0+kC5oNXOScDqU9QvymAohy+s8ZD74C9zoghZU4Ev2XKBo3QZq3lJYj7 9ePKKCmIfUQjFEaodbwzdEQow33CRTkjRrEZGB37ZPtjCdPJnxR14YXaf5cTepVcYB4TDZpAcY9 5HifAt3c4S+/j1Cale6u4WeH9bK/vaEGecz9kFW/A/XTW+25zSw5eEMVYhJ24G28IYe1GMf34ui 9BfB9JOHuGLeyO5csqJnK+rzsWshVGcqlKehKo4hg3p0CX903sO6t09KNsriU/MS3AHys83X5dD Z/VNwzLwmbHgZyl6PQs5DNen/kjbX1Qj46UvrH9DPjgjSRCR96qd/lStIw9v+Y7ih40A2uq2u4I x5hRwinv7fE= X-Received: by 2002:a05:6808:2516:b0:467:2f84:b0c6 with SMTP id 5614622812f47-485fb24e48cmr1018243b6e.8.1780100086346; Fri, 29 May 2026 17:14:46 -0700 (PDT) Received: from instance-20260526-181250.us-central1-a.c.kernel-lab-497518.internal (28.92.116.136.bc.googleusercontent.com. [136.116.92.28]) by smtp.gmail.com with ESMTPSA id 586e51a60fabf-43c93a22caasm2564178fac.2.2026.05.29.17.14.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 29 May 2026 17:14:46 -0700 (PDT) From: Purushothaman Ramalingam To: Zhu Yanjun Cc: Jason Gunthorpe , Leon Romanovsky , linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org, Purushothaman Ramalingam Subject: [PATCH] RDMA/rxe: fix UDP tunnel socket leak on rxe_newlink failure Date: Sat, 30 May 2026 00:12:51 +0000 Message-ID: <20260530001251.11136-1-purush.ramalingam@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" rxe_newlink() calls rxe_net_init() to set up the per-net-namespace UDP tunnel sockets before calling rxe_net_add() to create and register the rxe device. rxe_net_init() takes a reference on the IPv4 and IPv6 tunnel sockets, creating them if they do not already exist. If rxe_net_add() subsequently fails, rxe_newlink() returns the error without releasing those socket references. The normal teardown path, rxe_net_del(), is never reached because rxe_net_add() has already deallocated the rxe device on failure. As a result the tunnel socket references are leaked and the per-net sockets bound to UDP port 4791 can never be released. Release the references on the error path by adding rxe_net_uninit(), which performs the same socket teardown as rxe_net_del(). The shared release logic is factored into a helper to avoid duplication. Fixes: f1327abd6abe ("RDMA/rxe: Support RDMA link creation and destruction = per net namespace") Signed-off-by: Purushothaman Ramalingam Reviewed-by: Zhu Yanjun --- drivers/infiniband/sw/rxe/rxe.c | 1 + drivers/infiniband/sw/rxe/rxe_net.c | 32 ++++++++++++++++++++--------- drivers/infiniband/sw/rxe/rxe_net.h | 1 + 3 files changed, 24 insertions(+), 10 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rx= e.c index af39209d0fcf..bcc72b96ee00 100644 --- a/drivers/infiniband/sw/rxe/rxe.c +++ b/drivers/infiniband/sw/rxe/rxe.c @@ -243,6 +243,7 @@ static int rxe_newlink(const char *ibdev_name, struct n= et_device *ndev) err =3D rxe_net_add(ibdev_name, ndev); if (err) { rxe_err("failed to add %s\n", ndev->name); + rxe_net_uninit(ndev); goto err; } err: diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rx= e/rxe_net.c index 50a2cb5405e2..b98f66099dea 100644 --- a/drivers/infiniband/sw/rxe/rxe_net.c +++ b/drivers/infiniband/sw/rxe/rxe_net.c @@ -642,18 +642,10 @@ static void rxe_sock_put(struct sock *sk, } } =20 -void rxe_net_del(struct ib_device *dev) +/* release the per-net-namespace tunnel socket references held for @net */ +static void rxe_release_sockets(struct net *net) { - struct rxe_dev *rxe =3D container_of(dev, struct rxe_dev, ib_dev); - struct net_device *ndev; struct sock *sk; - struct net *net; - - ndev =3D rxe_ib_device_get_netdev(&rxe->ib_dev); - if (!ndev) - return; - - net =3D dev_net(ndev); =20 sk =3D rxe_ns_pernet_sk4(net); if (sk) @@ -662,6 +654,26 @@ void rxe_net_del(struct ib_device *dev) sk =3D rxe_ns_pernet_sk6(net); if (sk) rxe_sock_put(sk, rxe_ns_pernet_set_sk6, net); +} + +/* release the socket references taken by a successful rxe_net_init() when= a + * later step of device creation fails and rxe_net_del() will not be called + */ +void rxe_net_uninit(struct net_device *ndev) +{ + rxe_release_sockets(dev_net(ndev)); +} + +void rxe_net_del(struct ib_device *dev) +{ + struct rxe_dev *rxe =3D container_of(dev, struct rxe_dev, ib_dev); + struct net_device *ndev; + + ndev =3D rxe_ib_device_get_netdev(&rxe->ib_dev); + if (!ndev) + return; + + rxe_release_sockets(dev_net(ndev)); =20 dev_put(ndev); } diff --git a/drivers/infiniband/sw/rxe/rxe_net.h b/drivers/infiniband/sw/rx= e/rxe_net.h index 56249677d692..d55aacce2905 100644 --- a/drivers/infiniband/sw/rxe/rxe_net.h +++ b/drivers/infiniband/sw/rxe/rxe_net.h @@ -16,6 +16,7 @@ void rxe_net_del(struct ib_device *dev); =20 int rxe_register_notifier(void); int rxe_net_init(struct net_device *ndev); +void rxe_net_uninit(struct net_device *ndev); void rxe_net_exit(void); =20 #endif /* RXE_NET_H */ --=20 2.53.0