Repository navigation
Wait for route RCU callbacks in homa_peer_free_net - #144
Open
randomizedcoder wants to merge 1 commit into
Open
randomizedcoder wants to merge 1 commit into
randomizedcoder wants to merge 1 commit into
Conversation
homa_peer_free_net releases each route in the namespace with call_rcu(homa_route_free), and homa_route_free dereferences route->key.hnet to find the peertab. But hnet is the pernet data for the namespace, which cleanup_net frees right after the exit methods return (its rcu_barrier comes later). A callback that runs after that reads freed memory. Found by deleting network namespaces that had carried Homa traffic, in a VM: with init_on_free=1 every run oopsed in homa_route_free (6.12 and 7.3); without it, 3 of 8 runs on 7.3 hit a general protection fault there under load. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
randomizedcoder
added a commit
to randomizedcoder/HomaModule
that referenced
this pull request
Oct 31, 2026
…rmLab#148) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug:
homa_peer_free_netreleases routes withcall_rcu(homa_route_free), and the callback dereferencesroute->key.hnet.hnetis pernet data, whichcleanup_netfrees right after.exitreturns and before its ownrcu_barrier. That is a use-after-free when a namespace that carried Homa traffic is deleted, and also onrmmod(unregister_pernet_subsys frees the init_nethnetthe same way). It came in with 8db9f5e (routes).Fix: call
rcu_barrier()at the end ofhoma_peer_free_net, after dropping the lock.Found: by the nix microVM smoke test (
ip netns delafter GRO traffic). On 7.3 under load: GPF inhoma_route_freefromrcu_do_batchin 3 of 8 runs.Verified:
init_on_free=1, 6.12 + 7.3homa_route_freehoma_route_freehoma_peer_free_net__wait_for_rcu_callbacks--ipv4)The 7.3 build is clean both normal and
__STRIP__=1, and checkpatch is clean.🤖 Generated with Claude Code