[PATCH net] net: Defer netdev KOBJ_ADD uevent until the device is published

[PATCH net] net: Defer netdev KOBJ_ADD uevent until the device is published

[Dragos Tatulea]

netdev_register_kobject() calls device_add(), which emits KOBJ_ADD and
wakes udev, but register_netdevice() only makes the device findable by
name later, in list_netdevice().  A udev worker that reacts to the uevent
can therefore run against a device that no lookup can find yet.

This used to be harmless because the ethtool ioctl took the rtnl_lock
when looking the device up, and register_netdevice() runs under rtnl, so
the worker simply blocked until registration finished. The commit in the
fixes tag moved the lookup out from under rtnl for ops-locked drivers.
Now there is a short window in register_netdevice() between
netdev_register_kobject() until list_netdevice() when the device is not
findable by name.

This was reproduced with the mlx5 driver on a kernel with KASAN enabled
during devlink reload: systemd-udevd's net_driver builtin gets -ENODEV
from ETHTOOL_GDRVINFO, which was preventing interface renaming.

Suppress the uevent in netdev_register_kobject() and emit it from
register_netdevice() next to rtmsg_ifinfo(). This is the last point in
register_netdevice() where no error can happen, so only fully registered
devices are announced: the registration error paths never reach it, and
the device_del() that unwinds them stays silent as well, leaving
userspace with neither an add nor a remove.

Fixes: f994752b1127 ("net: ethtool: optionally skip rtnl_lock on IOCTL path")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
Reviewed-by: Shahar Shitrit <shshitrit@nvidia.com>
---
 net/core/dev.c       |  1 +
 net/core/net-sysfs.c | 16 ++++++++++++++++
 net/core/net-sysfs.h |  1 +
 3 files changed, 18 insertions(+)

diff --git a/net/core/dev.c b/net/core/dev.c
index c1c1be1a6962..32cc092d5d11 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -11499,6 +11499,7 @@ int register_netdevice(struct net_device *dev)
 	 *	Prevent userspace races by waiting until the network
 	 *	device is fully setup before sending notifications.
 	 */
+	netdev_uevent_add(dev);
 	if (!(dev->rtnl_link_ops && dev->rtnl_link_initializing))
 		rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U, GFP_KERNEL, 0, NULL);
 
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 0e71c9ed41e8..9a403259a3d0 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -2334,6 +2334,11 @@ int netdev_register_kobject(struct net_device *ndev)
 		*groups++ = &wireless_group;
 #endif /* CONFIG_SYSFS */
 
+	/* Hold back the KOBJ_ADD uevent until the device is discoverable
+	 * by name.
+	 */
+	dev_set_uevent_suppress(dev, 1);
+
 	error = device_add(dev);
 	if (error)
 		return error;
@@ -2349,6 +2354,17 @@ int netdev_register_kobject(struct net_device *ndev)
 	return error;
 }
 
+/* Announce a fully registered device to userspace. This pairs with the uevent
+ * suppression from netdev_register_kobject();
+ */
+void netdev_uevent_add(struct net_device *ndev)
+{
+	struct device *dev = &ndev->dev;
+
+	dev_set_uevent_suppress(dev, 0);
+	kobject_uevent(&dev->kobj, KOBJ_ADD);
+}
+
 /* Change owner for sysfs entries when moving network devices across network
  * namespaces owned by different user namespaces.
  */
diff --git a/net/core/net-sysfs.h b/net/core/net-sysfs.h
index 38e2e3ffd0bd..2f41a4dee866 100644
--- a/net/core/net-sysfs.h
+++ b/net/core/net-sysfs.h
@@ -4,6 +4,7 @@
 
 int __init netdev_kobject_init(void);
 int netdev_register_kobject(struct net_device *);
+void netdev_uevent_add(struct net_device *dev);
 void netdev_unregister_kobject(struct net_device *);
 int net_rx_queue_update_kobjects(struct net_device *, int old_num, int new_num);
 int netdev_queue_update_kobjects(struct net_device *net,
-- 
2.55.0

Re: [PATCH net] net: Defer netdev KOBJ_ADD uevent until the device is published

[Jakub Kicinski]

On Tue, 4 Aug 2026 18:51:01 +0300 Dragos Tatulea wrote:
> netdev_register_kobject() calls device_add(), which emits KOBJ_ADD and
> wakes udev, but register_netdevice() only makes the device findable by
> name later, in list_netdevice().  A udev worker that reacts to the uevent
> can therefore run against a device that no lookup can find yet.
> 
> This used to be harmless because the ethtool ioctl took the rtnl_lock
> when looking the device up, and register_netdevice() runs under rtnl, so
> the worker simply blocked until registration finished. The commit in the
> fixes tag moved the lookup out from under rtnl for ops-locked drivers.
> Now there is a short window in register_netdevice() between
> netdev_register_kobject() until list_netdevice() when the device is not
> findable by name.
> 
> This was reproduced with the mlx5 driver on a kernel with KASAN enabled
> during devlink reload: systemd-udevd's net_driver builtin gets -ENODEV
> from ETHTOOL_GDRVINFO, which was preventing interface renaming.
> 
> Suppress the uevent in netdev_register_kobject() and emit it from
> register_netdevice() next to rtmsg_ifinfo(). This is the last point in
> register_netdevice() where no error can happen, so only fully registered
> devices are announced: the registration error paths never reach it, and
> the device_del() that unwinds them stays silent as well, leaving
> userspace with neither an add nor a remove.
> 
> Fixes: f994752b1127 ("net: ethtool: optionally skip rtnl_lock on IOCTL path")
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
> Reviewed-by: Shahar Shitrit <shshitrit@nvidia.com>

LGTM, one nit..

>  net/core/dev.c       |  1 +
>  net/core/net-sysfs.c | 16 ++++++++++++++++
>  net/core/net-sysfs.h |  1 +
>  3 files changed, 18 insertions(+)
> 
> diff --git a/net/core/dev.c b/net/core/dev.c
> index c1c1be1a6962..32cc092d5d11 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
> @@ -11499,6 +11499,7 @@ int register_netdevice(struct net_device *dev)
>  	 *	Prevent userspace races by waiting until the network
>  	 *	device is fully setup before sending notifications.
>  	 */
> +	netdev_uevent_add(dev);
>  	if (!(dev->rtnl_link_ops && dev->rtnl_link_initializing))
>  		rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U, GFP_KERNEL, 0, NULL);
>  
> diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
> index 0e71c9ed41e8..9a403259a3d0 100644
> --- a/net/core/net-sysfs.c
> +++ b/net/core/net-sysfs.c
> @@ -2334,6 +2334,11 @@ int netdev_register_kobject(struct net_device *ndev)
>  		*groups++ = &wireless_group;
>  #endif /* CONFIG_SYSFS */
>  
> +	/* Hold back the KOBJ_ADD uevent until the device is discoverable
> +	 * by name.

nit: maybe just say "until the device is listed" ?
Or there's some less than obvious relevance of the name lookup 
vs ifindex lookup?

> +	 */
> +	dev_set_uevent_suppress(dev, 1);
> +
>  	error = device_add(dev);
>  	if (error)
>  		return error;
> @@ -2349,6 +2354,17 @@ int netdev_register_kobject(struct net_device *ndev)
>  	return error;
>  }
>  
> +/* Announce a fully registered device to userspace. This pairs with the uevent
> + * suppression from netdev_register_kobject();

nit: s/;/./ ?

> + */
> +void netdev_uevent_add(struct net_device *ndev)
> +{
> +	struct device *dev = &ndev->dev;
> +
> +	dev_set_uevent_suppress(dev, 0);
> +	kobject_uevent(&dev->kobj, KOBJ_ADD);
> +}

Please wait for Clashiko to cross-review before posting v2.
-- 
pw-bot: cr