Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor

[Hillf Danton <hdanton@sina.com>]

> Date: Thu, 26 Jun 2025 13:55:26 -0700
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    ee88bddf7f2f Merge tag 'bpf-fixes' of git://git.kernel.org..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=14367182580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
> dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
> compiler:       Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10e9008c580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10c12f0c580000

#syz test

--- x/drivers/infiniband/sw/rxe/rxe_net.c
+++ y/drivers/infiniband/sw/rxe/rxe_net.c
@@ -471,6 +471,7 @@ struct sk_buff *rxe_init_packet(struct r
 	struct net_device *ndev;
 	const struct ib_gid_attr *attr;
 	const int port_num = 1;
+	struct rxe_dev *rdev;
 
 	attr = rdma_get_gid_attr(&rxe->ib_dev, port_num, av->grh.sgid_index);
 	if (IS_ERR(attr))
@@ -503,6 +504,17 @@ struct sk_buff *rxe_init_packet(struct r
 	skb->dev	= ndev;
 	rcu_read_unlock();
 
+	rdev = rxe_get_dev_from_net(ndev);
+	if (!rdev && is_vlan_dev(ndev))
+		rdev = rxe_get_dev_from_net(vlan_dev_real_dev(ndev));
+	if (rdev)
+		ib_device_put(&rdev->ib_dev);
+	if (rdev != rxe) {
+		kfree_skb(skb);
+		skb = NULL;
+		goto out;
+	}
+
 	if (av->network_type == RXE_NETWORK_TYPE_IPV4)
 		skb->protocol = htons(ETH_P_IP);
 	else
--