[PATCH net] net: hsr: clean up the slave VLAN filters when deleting a port

[Jiayuan Chen <jiayuan.chen@linux.dev>]

Our internal syzkaller reported this warning:

  netdevsim netdevsim10 eth0: entered promiscuous mode
  netdevsim netdevsim10 eth1: entered promiscuous mode
  netdevsim netdevsim10 eth1 (unregistering): left promiscuous mode
  ------------[ cut here ]------------
  WARNING: drivers/net/netdevsim/netdev.c:1208 at nsim_destroy+0x276/0x6e0, CPU#3: 1/46
  Modules linked in:
  CPU: 3 UID: 0 PID: 46 Comm: kworker/u16:1 Not tainted 7.2.0-rc2+ #286 PREEMPT
  Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
  Workqueue: netns cleanup_net
  RIP: 0010:nsim_destroy (drivers/net/netdevsim/netdev.c:1031 drivers/net/netdevsim/netdev.c:1201)
  RSP: 0018:ffffc90000337898 EFLAGS: 00010293
  RAX: 0000000000000001 RBX: ffff8881036c8b00 RCX: 0000000000000000
  RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
  RBP: ffffc900003378f0 R08: 0000000000000000 R09: 0000000000000000
  R10: ffffffffad4186a8 R11: ffffffffad41c3db R12: ffff8881036c9268
  R13: dffffc0000000000 R14: ffffed10206d9164 R15: 0000000000000001
  FS:  0000000000000000(0000) GS:ffff888160866000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 000055bcf1a2e0c4 CR3: 0000000105376003 CR4: 0000000000770ef0
  PKRU: 55555554
  Call Trace:
  <TASK>
  __nsim_dev_port_del (drivers/net/netdevsim/dev.c:1547)
  nsim_dev_reload_destroy (drivers/net/netdevsim/dev.c:1561 drivers/net/netdevsim/dev.c:1785)
  nsim_dev_reload_down (drivers/net/netdevsim/dev.c:1038)
  devlink_reload (net/devlink/dev.c:462)
  devlink_pernet_pre_exit (net/devlink/core.c:578)
  ops_undo_list (net/core/net_namespace.c:161 net/core/net_namespace.c:235)
  cleanup_net (net/core/net_namespace.c:706)
  process_one_work (kernel/workqueue.c:3322)
  worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)
  kthread (kernel/kthread.c:436)
  ret_from_fork (arch/x86/kernel/process.c:158)
  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
  </TASK>
  ---[ end trace 0000000000000000 ]---
  netdevsim netdevsim10 eth0 (unregistering): left promiscuous mode

vlan_vids_add_by_dev() is what passes the VID filter info down to the real
device. A virtual device does no filtering itself, so it has to push the
VIDs down to its slaves. HSR already does this correctly on the add side:
hsr_ndo_vlan_rx_add_vid() calls vlan_vid_add() on each slave.

We just never clean the slaves up on delete. hsr_del_port() drops the port
and leaves the VIDs sitting on the slave, so the filter entries leak.
netdevsim keeps a bitmap of the VIDs it was told to filter and checks that
it is empty when the netdev goes away, which is what trips the warning
above.

So do the cleanup in hsr_del_port(). We follow hsr_ndo_vlan_rx_add_vid()
here: it only pushes the VIDs to HSR_PT_SLAVE_A and HSR_PT_SLAVE_B, so the
del side only touches those two as well.

Reproducer:
ip netns add ns0
ip netns exec ns0 sh -c 'echo "10 2" > /sys/bus/netdevsim/new_device'
ip netns exec ns0 ip link add hsr0 type hsr slave1 eth0 slave2 eth1
ip netns exec ns0 ip link add link hsr0 name hsr0.1 type vlan id 1
ip netns del ns0

Fixes: 1a8a63a5305e ("net: hsr: Add VLAN CTAG filter support")
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
 net/hsr/hsr_slave.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/hsr/hsr_slave.c b/net/hsr/hsr_slave.c
index d9af9e65f72f..b1baefb65c7a 100644
--- a/net/hsr/hsr_slave.c
+++ b/net/hsr/hsr_slave.c
@@ -237,6 +237,13 @@ void hsr_del_port(struct hsr_port *port)
 	list_del_rcu(&port->port_list);
 
 	if (port != master) {
+		/* Drop the VLAN ids that hsr_ndo_vlan_rx_add_vid() pushed down
+		 * to this slave. Only slave ports get them, see there.
+		 */
+		if (port->type == HSR_PT_SLAVE_A ||
+		    port->type == HSR_PT_SLAVE_B)
+			vlan_vids_del_by_dev(port->dev, master->dev);
+
 		netdev_update_features(master->dev);
 		dev_set_mtu(master->dev, hsr_get_max_mtu(hsr));
 		netdev_rx_handler_unregister(port->dev);
-- 
2.43.0