[PATCH net-next v3] netdev: avoid skipping objects on race with device disappearance

[PATCH net-next v3] netdev: avoid skipping objects on race with device disappearance

[Jakub Kicinski]

If the currently dumped device disappears while we were mid-dump
we will get the next device without resetting the sub-object ID.
This is quite unlikely, it was reported by an AI tool not a real
user. Let's fix it for better dump consistency.

We only intend to cover the case where device A disappears
and we skip over sub-objects of device B which was stable (B existed
before and after the dump). We don't intend to provide stable
results for any device that gets created or deleted during
the dump.

Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
v3: cover page pool dump as well
v2: https://lore.kernel.org/20260831164159.1124679-3-kuba@kernel.org
v1: https://lore.kernel.org/20260609190804.1137085-1-kuba@kernel.org
---
 net/core/netdev-genl.c    | 22 +++++++++++++++++-----
 net/core/page_pool_user.c |  8 ++++++--
 2 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/net/core/netdev-genl.c b/net/core/netdev-genl.c
index b8ba91cc93da..fa9edfdb32c2 100644
--- a/net/core/netdev-genl.c
+++ b/net/core/netdev-genl.c
@@ -312,11 +312,14 @@ int netdev_nl_napi_get_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
 			err = -ENODEV;
 		}
 	} else {
+		unsigned long start_ifindex = ctx->ifindex;
+
 		for_each_netdev_lock_scoped(net, netdev, ctx->ifindex) {
+			if (ctx->ifindex != start_ifindex)
+				ctx->napi_id = 0;
 			err = netdev_nl_napi_dump_one(netdev, skb, info, ctx);
 			if (err < 0)
 				break;
-			ctx->napi_id = 0;
 		}
 	}
 
@@ -636,13 +639,17 @@ int netdev_nl_queue_get_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
 			err = -ENODEV;
 		}
 	} else {
+		unsigned long start_ifindex = ctx->ifindex;
+
 		for_each_netdev_lock_ops_compat_scoped(net, netdev,
 						       ctx->ifindex) {
+			if (ctx->ifindex != start_ifindex) {
+				ctx->rxq_idx = 0;
+				ctx->txq_idx = 0;
+			}
 			err = netdev_nl_queue_dump_one(netdev, skb, info, ctx);
 			if (err < 0)
 				break;
-			ctx->rxq_idx = 0;
-			ctx->txq_idx = 0;
 		}
 	}
 
@@ -788,8 +795,6 @@ netdev_nl_stats_by_queue(struct net_device *netdev, struct sk_buff *rsp,
 		ctx->txq_idx = ++i;
 	}
 
-	ctx->rxq_idx = 0;
-	ctx->txq_idx = 0;
 	return 0;
 }
 
@@ -904,6 +909,7 @@ int netdev_nl_qstats_get_dumpit(struct sk_buff *skb,
 	struct netdev_nl_dump_ctx *ctx = netdev_dump_ctx(cb);
 	const struct genl_info *info = genl_info_dump(cb);
 	struct net *net = sock_net(skb->sk);
+	unsigned long start_ifindex;
 	struct net_device *netdev;
 	unsigned int ifindex;
 	unsigned int scope;
@@ -936,7 +942,13 @@ int netdev_nl_qstats_get_dumpit(struct sk_buff *skb,
 		return err;
 	}
 
+	start_ifindex = ctx->ifindex;
+
 	for_each_netdev_lock_ops_compat_scoped(net, netdev, ctx->ifindex) {
+		if (ctx->ifindex != start_ifindex) {
+			ctx->rxq_idx = 0;
+			ctx->txq_idx = 0;
+		}
 		err = netdev_nl_qstats_get_dump_one(netdev, scope, skb,
 						    info, ctx);
 		if (err < 0)
diff --git a/net/core/page_pool_user.c b/net/core/page_pool_user.c
index ef4261c0e8ea..f30f3779624c 100644
--- a/net/core/page_pool_user.c
+++ b/net/core/page_pool_user.c
@@ -84,6 +84,7 @@ netdev_nl_page_pool_get_dump(struct sk_buff *skb, struct netlink_callback *cb,
 	struct page_pool_dump_cb *state = (void *)cb->ctx;
 	const struct genl_info *info = genl_info_dump(cb);
 	struct net *net = sock_net(skb->sk);
+	unsigned long start_ifindex;
 	struct net_device *netdev;
 	struct page_pool *pool;
 	int err = 0;
@@ -91,6 +92,8 @@ netdev_nl_page_pool_get_dump(struct sk_buff *skb, struct netlink_callback *cb,
 	if (ifindex_attr)
 		state->ifindex = nla_get_u32(ifindex_attr);
 
+	start_ifindex = state->ifindex;
+
 	rtnl_lock();
 	mutex_lock(&page_pools_lock);
 	for_each_netdev_dump(net, netdev, state->ifindex) {
@@ -99,6 +102,9 @@ netdev_nl_page_pool_get_dump(struct sk_buff *skb, struct netlink_callback *cb,
 		    netdev->ifindex != nla_get_u32(ifindex_attr))
 			break;
 
+		if (state->ifindex != start_ifindex)
+			state->pp_id = 0;
+
 		hlist_for_each_entry(pool, &netdev->page_pools, user.list) {
 			if (state->pp_id && state->pp_id < pool->user.id)
 				continue;
@@ -108,8 +114,6 @@ netdev_nl_page_pool_get_dump(struct sk_buff *skb, struct netlink_callback *cb,
 			if (err)
 				goto out;
 		}
-
-		state->pp_id = 0;
 	}
 out:
 	mutex_unlock(&page_pools_lock);
-- 
2.55.0

Re: [PATCH net-next v3] netdev: avoid skipping objects on race with device disappearance

[Eric Dumazet]

On Fri, Sep 4, 2026 at 12:11 AM Jakub Kicinski <kuba@kernel.org> wrote:
>
> If the currently dumped device disappears while we were mid-dump
> we will get the next device without resetting the sub-object ID.
> This is quite unlikely, it was reported by an AI tool not a real
> user. Let's fix it for better dump consistency.
>
> We only intend to cover the case where device A disappears
> and we skip over sub-objects of device B which was stable (B existed
> before and after the dump). We don't intend to provide stable
> results for any device that gets created or deleted during
> the dump.

SGTM. Note an ifindex can be reused by a new device, we might need to
add a dev->dev_cookie
(64bit unique number) like we have for sockets and netns to also catch
this in the future.

Reviewed-by: Eric Dumazet <edumazet@google.com>

Re: [PATCH net-next v3] netdev: avoid skipping objects on race with device disappearance

[Jakub Kicinski]

On Fri, 4 Sep 2026 01:08:11 +0200 Eric Dumazet wrote:
> On Fri, Sep 4, 2026 at 12:11 AM Jakub Kicinski <kuba@kernel.org> wrote:
> > If the currently dumped device disappears while we were mid-dump
> > we will get the next device without resetting the sub-object ID.
> > This is quite unlikely, it was reported by an AI tool not a real
> > user. Let's fix it for better dump consistency.
> >
> > We only intend to cover the case where device A disappears
> > and we skip over sub-objects of device B which was stable (B existed
> > before and after the dump). We don't intend to provide stable
> > results for any device that gets created or deleted during
> > the dump.  
> 
> SGTM. Note an ifindex can be reused by a new device, we might need to
> add a dev->dev_cookie
> (64bit unique number) like we have for sockets and netns to also catch
> this in the future.

That would work. IDK if it's worth the LoC, tho. The existing workaround
is to subscribe to NEW/DEL notifications, do the dump, and then "apply"
the notifications. The notifications carry correct state of the objects
which were modified, the dump has to cover only "stable" objects.
At least that's the excuse I'm telling myself :)

Re: [PATCH net-next v3] netdev: avoid skipping objects on race with device disappearance

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu,  3 Sep 2026 15:11:54 -0700 you wrote:
> If the currently dumped device disappears while we were mid-dump
> we will get the next device without resetting the sub-object ID.
> This is quite unlikely, it was reported by an AI tool not a real
> user. Let's fix it for better dump consistency.
> 
> We only intend to cover the case where device A disappears
> and we skip over sub-objects of device B which was stable (B existed
> before and after the dump). We don't intend to provide stable
> results for any device that gets created or deleted during
> the dump.
> 
> [...]

Here is the summary with links:
  - [net-next,v3] netdev: avoid skipping objects on race with device disappearance
    https://git.kernel.org/netdev/net-next/c/761ae184f850

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html