[PATCH net-next] net: ipv4: clear dev->ip_ptr before destroying inetdev

[PATCH net-next] net: ipv4: clear dev->ip_ptr before destroying inetdev

[Yuyang Huang]

To prevent RCU readers from accessing a partially destroyed in_device,
clear dev->ip_ptr early in inetdev_destroy() before freeing the
multicast list and individual IP addresses. This aligns the IPv4 teardown
sequence with the IPv6 implementation.

Cc: Ido Schimmel <idosch@nvidia.com>
Cc: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Yuyang Huang <yuyanghuang@google.com>
---
 net/ipv4/devinet.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index a35b72662e43..3b31f4bec30e 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -322,6 +322,8 @@ static void inetdev_destroy(struct in_device *in_dev)
 
 	in_dev->dead = 1;
 
+	RCU_INIT_POINTER(dev->ip_ptr, NULL);
+
 	ip_mc_destroy_dev(in_dev);
 
 	while ((ifa = rtnl_dereference(in_dev->ifa_list)) != NULL) {
@@ -329,8 +331,6 @@ static void inetdev_destroy(struct in_device *in_dev)
 		inet_free_ifa(ifa);
 	}
 
-	RCU_INIT_POINTER(dev->ip_ptr, NULL);
-
 	devinet_sysctl_unregister(in_dev);
 	neigh_parms_release(&arp_tbl, in_dev->arp_parms);
 	arp_ifdown(dev);
-- 
2.55.0.795.g602f6c329a-goog

Re: [PATCH net-next] net: ipv4: clear dev->ip_ptr before destroying inetdev

[Ido Schimmel]

On Tue, Jul 07, 2026 at 01:30:39PM +0900, Yuyang Huang wrote:
> To prevent RCU readers from accessing a partially destroyed in_device,
> clear dev->ip_ptr early in inetdev_destroy() before freeing the
> multicast list and individual IP addresses. This aligns the IPv4 teardown
> sequence with the IPv6 implementation.
> 
> Cc: Ido Schimmel <idosch@nvidia.com>
> Cc: Kuniyuki Iwashima <kuniyu@google.com>
> Signed-off-by: Yuyang Huang <yuyanghuang@google.com>

I believe that sashiko-gemini [1] is right and you need to teach
prestera to ignore NETDEV_DOWN notifications in the inetaddr chain when
a RIF doesn't exist. Something like [2].

Regarding ieee80211_ifa_changed(), the net device is being tore down, so
failing to update the firmware ARP filter probably doesn't matter, but
you can do something like [3] to avoid it completely.

So, three patches where the last one aligns IPv4 with IPv6. Please check
if other listeners need to be adjusted (mlxsw is OK).

Thanks

[1] https://sashiko.dev/#/patchset/20260707043039.101983-1-yuyanghuang%40google.com

[2]
diff --git a/drivers/net/ethernet/marvell/prestera/prestera_router.c b/drivers/net/ethernet/marvell/prestera/prestera_router.c
index b036b173a308..0c4f462baa6e 100644
--- a/drivers/net/ethernet/marvell/prestera/prestera_router.c
+++ b/drivers/net/ethernet/marvell/prestera/prestera_router.c
@@ -1302,10 +1302,8 @@ static int __prestera_inetaddr_port_event(struct net_device *port_dev,
 		dev_hold(port_dev);
 		break;
 	case NETDEV_DOWN:
-		if (!re) {
-			NL_SET_ERR_MSG_MOD(extack, "Can't find RIF");
-			return -EEXIST;
-		}
+		if (!re)
+			return 0;
 		prestera_rif_entry_destroy(port->sw, re);
 		dev_put(port_dev);
 		break;

[3]
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 90d295cc364f..0e7a60dd1d8d 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -588,9 +588,7 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
 	if (sdata->vif.type != NL80211_IFTYPE_STATION)
 		return NOTIFY_DONE;
 
-	idev = __in_dev_get_rtnl(sdata->dev);
-	if (!idev)
-		return NOTIFY_DONE;
+	idev = ifa->ifa_dev;
 
 	ifmgd = &sdata->u.mgd;

Re: [PATCH net-next] net: ipv4: clear dev->ip_ptr before destroying inetdev

[Yuyang Huang]

On Fri, Jul 10, 2026 at 2:17 AM Ido Schimmel <idosch@nvidia.com> wrote:
>
> On Tue, Jul 07, 2026 at 01:30:39PM +0900, Yuyang Huang wrote:
> > To prevent RCU readers from accessing a partially destroyed in_device,
> > clear dev->ip_ptr early in inetdev_destroy() before freeing the
> > multicast list and individual IP addresses. This aligns the IPv4 teardown
> > sequence with the IPv6 implementation.
> >
> > Cc: Ido Schimmel <idosch@nvidia.com>
> > Cc: Kuniyuki Iwashima <kuniyu@google.com>
> > Signed-off-by: Yuyang Huang <yuyanghuang@google.com>
>
> I believe that sashiko-gemini [1] is right and you need to teach
> prestera to ignore NETDEV_DOWN notifications in the inetaddr chain when
> a RIF doesn't exist. Something like [2].
>
> Regarding ieee80211_ifa_changed(), the net device is being tore down, so
> failing to update the firmware ARP filter probably doesn't matter, but
> you can do something like [3] to avoid it completely.
>
> So, three patches where the last one aligns IPv4 with IPv6. Please check
> if other listeners need to be adjusted (mlxsw is OK).
>
> Thanks
>
> [1] https://sashiko.dev/#/patchset/20260707043039.101983-1-yuyanghuang%40google.com
>
> [2]
> diff --git a/drivers/net/ethernet/marvell/prestera/prestera_router.c b/drivers/net/ethernet/marvell/prestera/prestera_router.c
> index b036b173a308..0c4f462baa6e 100644
> --- a/drivers/net/ethernet/marvell/prestera/prestera_router.c
> +++ b/drivers/net/ethernet/marvell/prestera/prestera_router.c
> @@ -1302,10 +1302,8 @@ static int __prestera_inetaddr_port_event(struct net_device *port_dev,
>                 dev_hold(port_dev);
>                 break;
>         case NETDEV_DOWN:
> -               if (!re) {
> -                       NL_SET_ERR_MSG_MOD(extack, "Can't find RIF");
> -                       return -EEXIST;
> -               }
> +               if (!re)
> +                       return 0;
>                 prestera_rif_entry_destroy(port->sw, re);
>                 dev_put(port_dev);
>                 break;
>
> [3]
> diff --git a/net/mac80211/main.c b/net/mac80211/main.c
> index 90d295cc364f..0e7a60dd1d8d 100644
> --- a/net/mac80211/main.c
> +++ b/net/mac80211/main.c
> @@ -588,9 +588,7 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
>         if (sdata->vif.type != NL80211_IFTYPE_STATION)
>                 return NOTIFY_DONE;
>
> -       idev = __in_dev_get_rtnl(sdata->dev);
> -       if (!idev)
> -               return NOTIFY_DONE;
> +       idev = ifa->ifa_dev;
>
>         ifmgd = &sdata->u.mgd;

Thanks for the review comments; I will update prestera and ieee80211,
as well as go through other listeners to confirm the sequence and send
out stacked patches as suggested.

Thanks,

Yuyang