From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D195F37E316 for ; Tue, 14 Jul 2026 11:08:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784027285; cv=none; b=ULHAxnJ8UaCn+r3XOEswGOyI4MzwL2z1e+8TBPgmyOXtB5+iqgUV1v8lSFq9VwDPVX/5gusOm7X4yjqz6zPXoWWh7LfmHCbFdZNjkw2gbN5huYcE5kqdvu72JKlHXTbs8iCWRQj5QpupwAFxfeqoTvTc1MYGLrI7GTHg7QDdj9Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784027285; c=relaxed/simple; bh=ih29dVZmE/+d5QlQKOcIrFBA/q5MG1CcWhARzyB/d/I=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=WMa029U7ORIt/j1OgKGAgq3ij4Flka0GqX9vqi+UBiadsSszMb7aLPHQergovT4JQTk4bncWyVwk/tHBDDP1239y8W43Yg2tXgfiZ3PZkSrEqUWaqwoLLbNkvE8zLYgzauBWPAnyJ8kDXQ+QBX7J7BFJEel2ztO8FGxAXbeMu08= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=Ryh3ycIh; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Ryh3ycIh" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1784027282; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=15Oe3siE+6tkK5T1YlJbzX+vkvSSl3bQC8DQg9Cg5cw=; b=Ryh3ycIhsGM7XTSJW9+26U+xpG0qXK6ZHwBrPfAdXygAdnFG9MLyQxbZ9M8tgsOYJIGIvR 19jquWOq8mmFbYE5hyL6uOoX1iANpNbGlmN0BLMXKY0OpJIfFZE9GzWfI76UF3knOpSiVw bDdb/oH+HAOro6Fwp2uj9d67y1z5HMk= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-156-kitM1sFGPGCT8seEeTwcBA-1; Tue, 14 Jul 2026 07:07:59 -0400 X-MC-Unique: kitM1sFGPGCT8seEeTwcBA-1 X-Mimecast-MFC-AGG-ID: kitM1sFGPGCT8seEeTwcBA_1784027277 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 65D941956060; Tue, 14 Jul 2026 11:07:56 +0000 (UTC) Received: from thinkpad (headnet03.pony-001.prod.iad2.dc.redhat.com [10.2.32.114]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id B6A1830001BE; Tue, 14 Jul 2026 11:07:51 +0000 (UTC) Date: Tue, 14 Jul 2026 13:07:48 +0200 From: Felix Maurer To: Jiayuan Chen , Eric Dumazet Cc: netdev@vger.kernel.org, "David S. Miller" , Jakub Kicinski , Paolo Abeni , Simon Horman , Kees Cook , =?utf-8?Q?=C5=81ukasz?= Majewski , Fernando Fernandez Mancera , Hangbin Liu , Jakub Acs , Xiaoliang Yang , MD Danish Anwar , Murali Karicheri , Jiri Pirko , linux-kernel@vger.kernel.org Subject: Re: [PATCH net] net: hsr: clean up the slave VLAN filters when deleting a port Message-ID: References: <20260714080640.149654-1-jiayuan.chen@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260714080640.149654-1-jiayuan.chen@linux.dev> X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 On Tue, Jul 14, 2026 at 04:06:36PM +0800, Jiayuan Chen wrote: > Our internal syzkaller reported this warning: > > netdevsim netdevsim10 eth0: entered promiscuous mode > netdevsim netdevsim10 eth1: entered promiscuous mode > netdevsim netdevsim10 eth1 (unregistering): left promiscuous mode > ------------[ cut here ]------------ > WARNING: drivers/net/netdevsim/netdev.c:1208 at nsim_destroy+0x276/0x6e0, CPU#3: 1/46 > Modules linked in: > CPU: 3 UID: 0 PID: 46 Comm: kworker/u16:1 Not tainted 7.2.0-rc2+ #286 PREEMPT > Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 > Workqueue: netns cleanup_net > RIP: 0010:nsim_destroy (drivers/net/netdevsim/netdev.c:1031 drivers/net/netdevsim/netdev.c:1201) > RSP: 0018:ffffc90000337898 EFLAGS: 00010293 > RAX: 0000000000000001 RBX: ffff8881036c8b00 RCX: 0000000000000000 > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 > RBP: ffffc900003378f0 R08: 0000000000000000 R09: 0000000000000000 > R10: ffffffffad4186a8 R11: ffffffffad41c3db R12: ffff8881036c9268 > R13: dffffc0000000000 R14: ffffed10206d9164 R15: 0000000000000001 > FS: 0000000000000000(0000) GS:ffff888160866000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 000055bcf1a2e0c4 CR3: 0000000105376003 CR4: 0000000000770ef0 > PKRU: 55555554 > Call Trace: > > __nsim_dev_port_del (drivers/net/netdevsim/dev.c:1547) > nsim_dev_reload_destroy (drivers/net/netdevsim/dev.c:1561 drivers/net/netdevsim/dev.c:1785) > nsim_dev_reload_down (drivers/net/netdevsim/dev.c:1038) > devlink_reload (net/devlink/dev.c:462) > devlink_pernet_pre_exit (net/devlink/core.c:578) > ops_undo_list (net/core/net_namespace.c:161 net/core/net_namespace.c:235) > cleanup_net (net/core/net_namespace.c:706) > process_one_work (kernel/workqueue.c:3322) > worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486) > kthread (kernel/kthread.c:436) > ret_from_fork (arch/x86/kernel/process.c:158) > ret_from_fork_asm (arch/x86/entry/entry_64.S:245) > > ---[ end trace 0000000000000000 ]--- > netdevsim netdevsim10 eth0 (unregistering): left promiscuous mode > > vlan_vids_add_by_dev() is what passes the VID filter info down to the real > device. A virtual device does no filtering itself, so it has to push the > VIDs down to its slaves. HSR already does this correctly on the add side: > hsr_ndo_vlan_rx_add_vid() calls vlan_vid_add() on each slave. > > We just never clean the slaves up on delete. hsr_del_port() drops the port > and leaves the VIDs sitting on the slave, so the filter entries leak. > netdevsim keeps a bitmap of the VIDs it was told to filter and checks that > it is empty when the netdev goes away, which is what trips the warning > above. > > So do the cleanup in hsr_del_port(). We follow hsr_ndo_vlan_rx_add_vid() > here: it only pushes the VIDs to HSR_PT_SLAVE_A and HSR_PT_SLAVE_B, so the > del side only touches those two as well. > > Reproducer: > ip netns add ns0 > ip netns exec ns0 sh -c 'echo "10 2" > /sys/bus/netdevsim/new_device' > ip netns exec ns0 ip link add hsr0 type hsr slave1 eth0 slave2 eth1 > ip netns exec ns0 ip link add link hsr0 name hsr0.1 type vlan id 1 > ip netns del ns0 Thank you for your patch! The explanation and the patch look very similar to a fix that Eric posted a week ago [1]. Can you check if Eric's patch also fixes you reproducer? And if it does, please add your Tested-by and/or Reviewed-by to the thread? Thanks, Felix [1]: https://lore.kernel.org/netdev/20260707082327.3238690-1-edumazet@google.com/