[PATCH net] net: core: Fix the loop in default_device_exit_net()

[PATCH net] net: core: Fix the loop in default_device_exit_net()

[Haiyang Zhang]

From: Haiyang Zhang <haiyangz@microsoft.com>

The loop in default_device_exit_net() won't be able to properly detect the
head then stop, and will hit NULL pointer, when a driver, like hv_netvsc,
automatically moves the slave device together with the master device.

To fix this, add a helper function to return the first migratable netdev
correctly, no matter one or two devices were removed from this net's list
in the last iteration.

Cc: stable@vger.kernel.org # 5.4+
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
---
 net/core/dev.c | 31 +++++++++++++++++++++----------
 1 file changed, 21 insertions(+), 10 deletions(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index 621a639aeba1..d83f5f12cf70 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -12629,19 +12629,11 @@ static struct pernet_operations __net_initdata netdev_net_ops = {
 	.exit = netdev_exit,
 };
 
-static void __net_exit default_device_exit_net(struct net *net)
+static inline struct net_device *first_migratable_netdev(struct net *net)
 {
-	struct netdev_name_node *name_node, *tmp;
 	struct net_device *dev, *aux;
-	/*
-	 * Push all migratable network devices back to the
-	 * initial network namespace
-	 */
-	ASSERT_RTNL();
-	for_each_netdev_safe(net, dev, aux) {
-		int err;
-		char fb_name[IFNAMSIZ];
 
+	for_each_netdev_safe(net, dev, aux) {
 		/* Ignore unmoveable devices (i.e. loopback) */
 		if (dev->netns_immutable)
 			continue;
@@ -12650,6 +12642,25 @@ static void __net_exit default_device_exit_net(struct net *net)
 		if (dev->rtnl_link_ops && !dev->rtnl_link_ops->netns_refund)
 			continue;
 
+		return dev;
+	}
+
+	return NULL;
+}
+
+static void __net_exit default_device_exit_net(struct net *net)
+{
+	struct netdev_name_node *name_node, *tmp;
+	struct net_device *dev;
+	/*
+	 * Push all migratable network devices back to the
+	 * initial network namespace
+	 */
+	ASSERT_RTNL();
+	while ((dev = first_migratable_netdev(net)) != NULL) {
+		int err;
+		char fb_name[IFNAMSIZ];
+
 		/* Push remaining network devices to init_net */
 		snprintf(fb_name, IFNAMSIZ, "dev%d", dev->ifindex);
 		if (netdev_name_in_use(&init_net, fb_name))
-- 
2.34.1

Re: [PATCH net] net: core: Fix the loop in default_device_exit_net()

[Jakub Kicinski]

On Fri, 18 Jul 2025 13:20:14 -0700 Haiyang Zhang wrote:
> The loop in default_device_exit_net() won't be able to properly detect the
> head then stop, and will hit NULL pointer, when a driver, like hv_netvsc,
> automatically moves the slave device together with the master device.
> 
> To fix this, add a helper function to return the first migratable netdev
> correctly, no matter one or two devices were removed from this net's list
> in the last iteration.

FTR I think that what the driver is trying to do is way too hacky, and
it should be fixed instead. But I defer to Kuniyuki for the final word,
maybe this change is useful for other reasons..

Re: [PATCH net] net: core: Fix the loop in default_device_exit_net()

[Kuniyuki Iwashima]

On Fri, Jul 18, 2025 at 4:37 PM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Fri, 18 Jul 2025 13:20:14 -0700 Haiyang Zhang wrote:
> > The loop in default_device_exit_net() won't be able to properly detect the
> > head then stop, and will hit NULL pointer, when a driver, like hv_netvsc,
> > automatically moves the slave device together with the master device.
> >
> > To fix this, add a helper function to return the first migratable netdev
> > correctly, no matter one or two devices were removed from this net's list
> > in the last iteration.
>
> FTR I think that what the driver is trying to do is way too hacky, and
> it should be fixed instead. But I defer to Kuniyuki for the final word,
> maybe this change is useful for other reasons..

I agree that it should be fixed on the driver side.  I don't
think of a good reason for the change.

RE: [EXTERNAL] Re: [PATCH net] net: core: Fix the loop in default_device_exit_net()

[Haiyang Zhang]

> -----Original Message-----
> From: Kuniyuki Iwashima <kuniyu@google.com>
> Sent: Saturday, July 19, 2025 4:48 PM
> To: Jakub Kicinski <kuba@kernel.org>
> Cc: Haiyang Zhang <haiyangz@linux.microsoft.com>; linux-
> hyperv@vger.kernel.org; netdev@vger.kernel.org; Haiyang Zhang
> <haiyangz@microsoft.com>; KY Srinivasan <kys@microsoft.com>;
> wei.liu@kernel.org; edumazet@google.com; pabeni@redhat.com;
> horms@kernel.org; davem@davemloft.net; sdf@fomichev.me;
> ahmed.zaki@intel.com; aleksander.lobakin@intel.com; linux-
> kernel@vger.kernel.org
> Subject: [EXTERNAL] Re: [PATCH net] net: core: Fix the loop in
> default_device_exit_net()
> 
> [You don't often get email from kuniyu@google.com. Learn why this is
> important at https://aka.ms/LearnAboutSenderIdentification ]
> 
> On Fri, Jul 18, 2025 at 4:37 PM Jakub Kicinski <kuba@kernel.org> wrote:
> >
> > On Fri, 18 Jul 2025 13:20:14 -0700 Haiyang Zhang wrote:
> > > The loop in default_device_exit_net() won't be able to properly detect
> the
> > > head then stop, and will hit NULL pointer, when a driver, like
> hv_netvsc,
> > > automatically moves the slave device together with the master device.
> > >
> > > To fix this, add a helper function to return the first migratable
> netdev
> > > correctly, no matter one or two devices were removed from this net's
> list
> > > in the last iteration.
> >
> > FTR I think that what the driver is trying to do is way too hacky, and
> > it should be fixed instead. But I defer to Kuniyuki for the final word,
> > maybe this change is useful for other reasons..
> 
> I agree that it should be fixed on the driver side.  I don't
> think of a good reason for the change.

Kuniyuki and Jakub:

Thanks for the reviews. I'm working on a patch that will fix the driver side.

- Haiyang

Re: [PATCH net] net: core: Fix the loop in default_device_exit_net()

[Eric Dumazet]

On Fri, Jul 18, 2025 at 1:21 PM Haiyang Zhang
<haiyangz@linux.microsoft.com> wrote:
>
> From: Haiyang Zhang <haiyangz@microsoft.com>
>
> The loop in default_device_exit_net() won't be able to properly detect the
> head then stop, and will hit NULL pointer, when a driver, like hv_netvsc,
> automatically moves the slave device together with the master device.
>
> To fix this, add a helper function to return the first migratable netdev
> correctly, no matter one or two devices were removed from this net's list
> in the last iteration.
>
> Cc: stable@vger.kernel.org # 5.4+

We (network maintainers) prefer a Fixes: tag, so that we can look at
the blamed patch, rather than trusting your '5.4' hint.

Without a Fixes tag, you are forcing each reviewer to do the
archeology work, and possibly completely miss your point.

RE: [EXTERNAL] Re: [PATCH net] net: core: Fix the loop in default_device_exit_net()

[Haiyang Zhang]

> -----Original Message-----
> From: Eric Dumazet <edumazet@google.com>
> Sent: Tuesday, July 22, 2025 2:52 AM
> To: Haiyang Zhang <haiyangz@linux.microsoft.com>
> Cc: linux-hyperv@vger.kernel.org; netdev@vger.kernel.org; Haiyang Zhang
> <haiyangz@microsoft.com>; KY Srinivasan <kys@microsoft.com>;
> wei.liu@kernel.org; kuba@kernel.org; pabeni@redhat.com; horms@kernel.org;
> davem@davemloft.net; sdf@fomichev.me; kuniyu@google.com;
> ahmed.zaki@intel.com; aleksander.lobakin@intel.com; linux-
> kernel@vger.kernel.org; stable@vger.kernel.org; #@linux.microsoft.com;
> 5.4+@linux.microsoft.com
> Subject: [EXTERNAL] Re: [PATCH net] net: core: Fix the loop in
> default_device_exit_net()
> 
> On Fri, Jul 18, 2025 at 1:21 PM Haiyang Zhang
> <haiyangz@linux.microsoft.com> wrote:
> >
> > From: Haiyang Zhang <haiyangz@microsoft.com>
> >
> > The loop in default_device_exit_net() won't be able to properly detect
> the
> > head then stop, and will hit NULL pointer, when a driver, like
> hv_netvsc,
> > automatically moves the slave device together with the master device.
> >
> > To fix this, add a helper function to return the first migratable netdev
> > correctly, no matter one or two devices were removed from this net's
> list
> > in the last iteration.
> >
> > Cc: stable@vger.kernel.org # 5.4+
> 
> We (network maintainers) prefer a Fixes: tag, so that we can look at
> the blamed patch, rather than trusting your '5.4' hint.
> 
> Without a Fixes tag, you are forcing each reviewer to do the
> archeology work, and possibly completely miss your point.

Thanks. I will have the Fixes tag in the new patch.

- Haiyang