mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Serhat Kumral <serhatkumral1@gmail.com>
To: yanjun.zhu@linux.dev
Cc: zyjzyj2000@gmail.com, xiongwm2026@163.com, jgg@ziepe.ca,
	leon@kernel.org, dsahern@kernel.org, linux-rdma@vger.kernel.org,
	linux-kernel@vger.kernel.org, serhatkumral1@gmail.com,
	syzbot+8c9eede336e3a843750e@syzkaller.appspotmail.com
Subject: Re: [RFC PATCH 1/2] RDMA/rxe: drive UDP tunnel socket lifetime from the GID table
Date: Mon, 27 Jul 2026 22:55:21 +0300	[thread overview]
Message-ID: <20260727195521.34907-1-serhatkumral1@gmail.com> (raw)
In-Reply-To: <20260726140253.26870-1-serhatkumral1@gmail.com>

I was pointed at Weimin Xiong's "RDMA/rxe: Hold netdev reference for
transmit skbs" (v3, 20260716055255.157674-1-xiongwm2026@163.com) and
tested with it applied.

That patch and this series conflict in rxe_notify(). Its hunk carries
"rxe_net_del(&rxe->ib_dev);" as a context line, and this series removes
that call together with the function, so neither order applies with a
plain git apply. I resolved it by keeping both rxe_flush_qps() calls and
dropping the rxe_net_del() line:

	case NETDEV_GOING_DOWN:
		/* Start draining TX queues before the netdev disappears. */
		rxe_flush_qps(rxe);
		break;
	case NETDEV_UNREGISTER:
		rxe_flush_qps(rxe);
		ib_unregister_device_queued(&rxe->ib_dev);
		break;

If the tree where the crash appears resolves it differently, that
difference is worth seeing.

Four kernels on f2ec6312bf71, same config and toolchain as before, 120
runs of rxe_rping_between_netns.sh each:

  f2ec6312bf71                            120/120
  + this series                           120/120
  + the netdev reference patch            120/120
  + the netdev reference patch + series   120/120

No KASAN report, GPF, Oops, refcount warning, lockdep splat, hung task or
RCU stall in any of them. The module symbol tables confirm each kernel
carries what it should: rxe_flush_qps only in the two with the netdev
reference patch, rxe_add_gid and rxe_del_gid only in the two with this
series.

Four kernels reporting nothing made me doubt the setup rather than the
result, so I checked that it reports faults at all: a deliberate NULL
pointer dereference injected into the rxe transmit path, during the same
selftest, gives

  [   69.131350] Oops: general protection fault, kernel NULL pointer
    dereference 0x39: 0000 [#1] SMP KASAN NOPTI
  [   69.141660] Workqueue: rxe_wq do_work [rdma_rxe]

It reaches the console I capture, my filters count it, and the iteration
is recorded as failed. From userspace the selftest just hangs.

So it still does not reproduce here.

thanks,
serhat

  reply	other threads:[~2026-07-27 19:55 UTC|newest]

Thread overview: 19+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-18 14:26 Serhat Kumral
2026-07-18 14:26 ` [RFC PATCH 2/2] RDMA/nldev: remove the unused dellink link op Serhat Kumral
2026-07-18 15:39 ` [RFC PATCH 1/2] RDMA/rxe: drive UDP tunnel socket lifetime from the GID table Jason Gunthorpe
2026-07-19 17:54   ` Serhat Kumral
2026-08-10 18:06     ` Jason Gunthorpe
2026-08-14  9:54       ` Serhat Kumral
2026-07-18 16:01 ` Zhu Yanjun
2026-07-18 16:04   ` Jason Gunthorpe
2026-07-19  5:08 ` Zhu Yanjun
2026-07-19 17:59   ` Serhat Kumral
2026-07-19 20:50     ` Zhu Yanjun
2026-07-19 21:13       ` Zhu Yanjun
2026-07-20 18:15         ` Serhat Kumral
2026-07-20 19:19           ` yanjun.zhu
2026-07-26 14:02             ` Serhat Kumral
2026-07-27 19:55               ` Serhat Kumral [this message]
2026-07-28  3:42                 ` Zhu Yanjun
     [not found] <c225c004-1fa9-4010-a843-8be033003e93@163.com>
2026-07-28 17:28 ` Serhat Kumral
2026-07-29  3:21   ` Zhu Yanjun

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260727195521.34907-1-serhatkumral1@gmail.com \
    --to=serhatkumral1@gmail.com \
    --cc=dsahern@kernel.org \
    --cc=jgg@ziepe.ca \
    --cc=leon@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-rdma@vger.kernel.org \
    --cc=syzbot+8c9eede336e3a843750e@syzkaller.appspotmail.com \
    --cc=xiongwm2026@163.com \
    --cc=yanjun.zhu@linux.dev \
    --cc=zyjzyj2000@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®