[PATCH] RDMA/rxe: Fix use-after-free of netdev in smc_ib_port_event_work

[Jordan Walters <jaggyaur@gmail.com>]

rxe_net_del() drops its reference to the underlying net_device
via dev_put() but does not clear the netdev pointer from the
ib_device. This leaves a dangling pointer that the async
smc_ib_port_event_work worker can dereference after the
net_device has been freed, causing a use-after-free in
__ethtool_get_link_ksettings().

An unprivileged user can trigger this via user namespaces
by creating a dummy interface, binding it to rdma_rxe, and
immediately destroying the namespace before the worker fires.

Clear the netdev pointer via ib_device_set_netdev() before
releasing the reference. Downstream callers such as
ib_get_eth_speed() already handle a NULL netdev safely.

Note: this is a distinct issue from the socket TOCTOU race
fixed by Zhu Yanjun in [1]. That patch addresses a race on
the pernet socket pointers (rxe_sk4/sk6) leading to a NULL
deref in kernel_sock_shutdown(). This patch fixes a dangling
netdev pointer leading to a UAF in
__ethtool_get_link_ksettings via smc_ib_port_event_work.

Link: https://lore.kernel.org/all/20260519023541.8594-1-yanjun.zhu@linux.dev/ [1]

Signed-off-by: Jordan Walters <jaggyaur@gmail.com>
---
 drivers/infiniband/sw/rxe/rxe_net.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
index 50a2cb5405e2..a8f91d6e3b17 100644
--- a/drivers/infiniband/sw/rxe/rxe_net.c
+++ b/drivers/infiniband/sw/rxe/rxe_net.c
@@ -663,6 +663,7 @@ void rxe_net_del(struct ib_device *dev)
 	if (sk)
 		rxe_sock_put(sk, rxe_ns_pernet_set_sk6, net);
 
+	ib_device_set_netdev(dev, NULL, 1);
 	dev_put(ndev);
 }
 
-- 
2.49.0