Re: [PATCH net] net: flow_offload: protect driver_block_list in flow_block_cb_setup_simple()

[Jakub Kicinski <kuba@kernel.org>]

On Wed, 11 Feb 2026 13:06:48 +0100 Florian Westphal wrote:
> Shigeru Yoshida <syoshida@redhat.com> wrote:
> > syzbot reported a list_del corruption in flow_block_cb_setup_simple(). [0]
> > 
> > flow_block_cb_setup_simple() accesses the driver_block_list (e.g.,
> > netdevsim's nsim_block_cb_list) without any synchronization. The
> > nftables offload path calls into this function via ndo_setup_tc while
> > holding the per-netns commit_mutex, but this mutex does not prevent
> > concurrent access from tasks in different network namespaces that
> > share the same driver_block_list, leading to list corruption:
> > 
> > - Task A (FLOW_BLOCK_BIND) calls list_add_tail() to insert a new
> >   flow_block_cb into driver_block_list.
> > 
> > - Task B (FLOW_BLOCK_UNBIND) concurrently calls list_del() on another
> >   flow_block_cb from the same list.  
> 
> Looking at the *upper layer*, I don't think it expected drivers to use
> a single global list for this bit something that is scoped to the
> net_device.

Maybe subjective but the fix seems a little off to me.
Isn't flow_block_cb_setup_simple() just a "simple" implementation 
for reuse in drivers locking in there doesn't really guarantee much?

If we think netdevsim is doing something odd, let's make it work
like real drivers.

TBH I thought block setup was always under rtnl_lock.