public inbox for netdev@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH] ipv4: don't call inetdev_init() if device is no longer registered
@ 2026-01-25  5:11 Tetsuo Handa
  2026-01-25  8:58 ` Ido Schimmel
  0 siblings, 1 reply; 10+ messages in thread
From: Tetsuo Handa @ 2026-01-25  5:11 UTC (permalink / raw)
  To: Breno Leitao, David S. Miller, David Ahern, Eric Dumazet,
	Jakub Kicinski, Paolo Abeni, Simon Horman, Network Development,
	Jiri Pirko

syzbot is reporting

  unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 3
  ref_tracker: netdev@ffff88807dcf8618 has 1/2 users at
       __netdev_tracker_alloc include/linux/netdevice.h:4400 [inline]
       netdev_hold include/linux/netdevice.h:4429 [inline]
       inetdev_init+0x201/0x4e0 net/ipv4/devinet.c:286
       inetdev_event+0x251/0x1610 net/ipv4/devinet.c:1600
       notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
       call_netdevice_notifiers_mtu net/core/dev.c:2318 [inline]
       netif_set_mtu_ext+0x5aa/0x800 net/core/dev.c:9886
       netif_set_mtu+0xd7/0x1b0 net/core/dev.c:9907
       dev_set_mtu+0x126/0x260 net/core/dev_api.c:248
       team_port_del+0xb07/0xcb0 drivers/net/team/team_core.c:1333
       team_del_slave drivers/net/team/team_core.c:1936 [inline]
       team_device_event+0x207/0x5b0 drivers/net/team/team_core.c:2929
       notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
       call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
       call_netdevice_notifiers net/core/dev.c:2295 [inline]
       __dev_change_net_namespace+0xcb7/0x2050 net/core/dev.c:12592
       do_setlink+0x2ce/0x4590 net/core/rtnetlink.c:3060
       rtnl_changelink net/core/rtnetlink.c:3776 [inline]
       __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
       rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
       rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
       netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
       netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
       netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
       netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894

problem, for commit 06770843c2f0 ("ipv: Re-enable IP when MTU > 68")
did not expect that NETDEV_CHANGEMTU event is fired as a part of
NETDEV_UNREGISTER event.

Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
Fixes: 06770843c2f0 ("ipv: Re-enable IP when MTU > 68")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
---
Since there is no reproducer for this problem, I can't test this change.
But I think that ref_tracker indicates that NETDEV_CHANGEMTU event from
NETDEV_UNREGISTER event is causing netdev_hold() on NETREG_UNREGISTERING
device.

 net/ipv4/devinet.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 942a887bf089..dc4359bfa103 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1594,7 +1594,7 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
 				IN_DEV_CONF_SET(in_dev, NOXFRM, 1);
 				IN_DEV_CONF_SET(in_dev, NOPOLICY, 1);
 			}
-		} else if (event == NETDEV_CHANGEMTU) {
+		} else if (event == NETDEV_CHANGEMTU && dev->reg_state != NETREG_UNREGISTERING) {
 			/* Re-enabling IP */
 			if (inetdev_valid_mtu(dev->mtu))
 				in_dev = inetdev_init(dev);
-- 
2.47.3


^ permalink raw reply related	[flat|nested] 10+ messages in thread

* Re: [PATCH] ipv4: don't call inetdev_init() if device is no longer registered
  2026-01-25  5:11 [PATCH] ipv4: don't call inetdev_init() if device is no longer registered Tetsuo Handa
@ 2026-01-25  8:58 ` Ido Schimmel
  2026-01-25 11:21   ` Tetsuo Handa
  0 siblings, 1 reply; 10+ messages in thread
From: Ido Schimmel @ 2026-01-25  8:58 UTC (permalink / raw)
  To: Tetsuo Handa
  Cc: Breno Leitao, David S. Miller, David Ahern, Eric Dumazet,
	Jakub Kicinski, Paolo Abeni, Simon Horman, Network Development,
	Jiri Pirko

On Sun, Jan 25, 2026 at 02:11:16PM +0900, Tetsuo Handa wrote:
> syzbot is reporting
> 
>   unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 3
>   ref_tracker: netdev@ffff88807dcf8618 has 1/2 users at
>        __netdev_tracker_alloc include/linux/netdevice.h:4400 [inline]
>        netdev_hold include/linux/netdevice.h:4429 [inline]
>        inetdev_init+0x201/0x4e0 net/ipv4/devinet.c:286
>        inetdev_event+0x251/0x1610 net/ipv4/devinet.c:1600
>        notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
>        call_netdevice_notifiers_mtu net/core/dev.c:2318 [inline]
>        netif_set_mtu_ext+0x5aa/0x800 net/core/dev.c:9886
>        netif_set_mtu+0xd7/0x1b0 net/core/dev.c:9907
>        dev_set_mtu+0x126/0x260 net/core/dev_api.c:248
>        team_port_del+0xb07/0xcb0 drivers/net/team/team_core.c:1333
>        team_del_slave drivers/net/team/team_core.c:1936 [inline]
>        team_device_event+0x207/0x5b0 drivers/net/team/team_core.c:2929
>        notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
>        call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
>        call_netdevice_notifiers net/core/dev.c:2295 [inline]
>        __dev_change_net_namespace+0xcb7/0x2050 net/core/dev.c:12592
>        do_setlink+0x2ce/0x4590 net/core/rtnetlink.c:3060
>        rtnl_changelink net/core/rtnetlink.c:3776 [inline]
>        __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
>        rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
>        rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
>        netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
>        netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
>        netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
>        netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
> 
> problem, for commit 06770843c2f0 ("ipv: Re-enable IP when MTU > 68")
> did not expect that NETDEV_CHANGEMTU event is fired as a part of
> NETDEV_UNREGISTER event.
> 
> Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
> Fixes: 06770843c2f0 ("ipv: Re-enable IP when MTU > 68")
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> ---
> Since there is no reproducer for this problem, I can't test this change.
> But I think that ref_tracker indicates that NETDEV_CHANGEMTU event from
> NETDEV_UNREGISTER event is causing netdev_hold() on NETREG_UNREGISTERING
> device.

Thanks for the report and fix. You can reproduce with [1], but the
proposed fix doesn't help. Problem is that NETDEV_UNREGISTER is first
caught by inetdev_event(), which calls inetdev_destroy(), but then the
team driver restores dummy1's MTU and initializes the idev again.

[1]
ip link add name team1 type team
ip link add name dummy1 mtu 1499 master team1 type dummy
ip netns add bla
ip link set dev dummy1 netns bla
ip -n bla link del dev dummy1

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [PATCH] ipv4: don't call inetdev_init() if device is no longer registered
  2026-01-25  8:58 ` Ido Schimmel
@ 2026-01-25 11:21   ` Tetsuo Handa
  2026-01-25 12:15     ` Ido Schimmel
  0 siblings, 1 reply; 10+ messages in thread
From: Tetsuo Handa @ 2026-01-25 11:21 UTC (permalink / raw)
  To: Ido Schimmel, Jiri Pirko
  Cc: Breno Leitao, David S. Miller, David Ahern, Eric Dumazet,
	Jakub Kicinski, Paolo Abeni, Simon Horman, Network Development

On 2026/01/25 17:58, Ido Schimmel wrote:
> Thanks for the report and fix. You can reproduce with [1], but the
> proposed fix doesn't help. Problem is that NETDEV_UNREGISTER is first
> caught by inetdev_event(), which calls inetdev_destroy(), but then the
> team driver restores dummy1's MTU and initializes the idev again.

Thank you for the reproducer. I thought the proposed patch can prevent
the idev from initializing again, but your reproducer showed that it can't
because dev->reg_state == NETREG_REGISTERED.

We would need to update team driver side not to trigger dev_set_mtu().
Below diff passed the reproducer, but I don't know whether it is safe
to trigger dev_set_mtu() for team_uninit() and team_del_slave() and
the err_port_enter: label of team_port_add()...

 drivers/net/team/team_core.c |   20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
index c08a5c1bd6e4..30c89490545a 100644
--- a/drivers/net/team/team_core.c
+++ b/drivers/net/team/team_core.c
@@ -1292,7 +1292,7 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
 
 static void __team_port_change_port_removed(struct team_port *port);
 
-static int team_port_del(struct team *team, struct net_device *port_dev)
+static int team_port_del(struct team *team, struct net_device *port_dev, bool no_restore)
 {
 	struct net_device *dev = team->dev;
 	struct team_port *port;
@@ -1330,7 +1330,8 @@ static int team_port_del(struct team *team, struct net_device *port_dev)
 	__team_port_change_port_removed(port);
 
 	team_port_set_orig_dev_addr(port);
-	dev_set_mtu(port_dev, port->orig.mtu);
+	if (!no_restore)
+		dev_set_mtu(port_dev, port->orig.mtu);
 	kfree_rcu(port, rcu);
 	netdev_info(dev, "Port device %s removed\n", portname);
 	netdev_compute_master_upper_features(team->dev, true);
@@ -1634,7 +1635,7 @@ static void team_uninit(struct net_device *dev)
 	ASSERT_RTNL();
 
 	list_for_each_entry_safe(port, tmp, &team->port_list, list)
-		team_port_del(team, port->dev);
+		team_port_del(team, port->dev, false);
 
 	__team_change_mode(team, NULL); /* cleanup */
 	__team_options_unregister(team, team_options, ARRAY_SIZE(team_options));
@@ -1933,7 +1934,16 @@ static int team_del_slave(struct net_device *dev, struct net_device *port_dev)
 
 	ASSERT_RTNL();
 
-	return team_port_del(team, port_dev);
+	return team_port_del(team, port_dev, false);
+}
+
+static int team_del_slave_no_restore(struct net_device *dev, struct net_device *port_dev)
+{
+	struct team *team = netdev_priv(dev);
+
+	ASSERT_RTNL();
+
+	return team_port_del(team, port_dev, true);
 }
 
 static netdev_features_t team_fix_features(struct net_device *dev,
@@ -2926,7 +2936,7 @@ static int team_device_event(struct notifier_block *unused,
 					       !!netif_oper_up(port->dev));
 		break;
 	case NETDEV_UNREGISTER:
-		team_del_slave(port->team->dev, dev);
+		team_del_slave_no_restore(port->team->dev, dev);
 		break;
 	case NETDEV_FEAT_CHANGE:
 		if (!port->team->notifier_ctx) {


^ permalink raw reply related	[flat|nested] 10+ messages in thread

* Re: [PATCH] ipv4: don't call inetdev_init() if device is no longer registered
  2026-01-25 11:21   ` Tetsuo Handa
@ 2026-01-25 12:15     ` Ido Schimmel
  2026-01-25 14:35       ` [PATCH] team: avoid NETDEV_CHANGEMTU event when unregistering slave Tetsuo Handa
  0 siblings, 1 reply; 10+ messages in thread
From: Ido Schimmel @ 2026-01-25 12:15 UTC (permalink / raw)
  To: Tetsuo Handa
  Cc: Jiri Pirko, Breno Leitao, David S. Miller, David Ahern,
	Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
	Network Development

On Sun, Jan 25, 2026 at 08:21:08PM +0900, Tetsuo Handa wrote:
> We would need to update team driver side not to trigger dev_set_mtu().
> Below diff passed the reproducer, but I don't know whether it is safe
> to trigger dev_set_mtu() for team_uninit() and team_del_slave() and
> the err_port_enter: label of team_port_add()...

I just checked and the same issue was fixed in the bond driver in commit
f51048c3e07b ("bonding: avoid NETDEV_CHANGEMTU event when unregistering
slave"), so I would try a similar fix in team.

A solution in the core would be better, but I don't know if it's
possible and the blast radius would also be bigger, so it's something to
think about for net-next.

^ permalink raw reply	[flat|nested] 10+ messages in thread

* [PATCH] team: avoid NETDEV_CHANGEMTU event when unregistering slave
  2026-01-25 12:15     ` Ido Schimmel
@ 2026-01-25 14:35       ` Tetsuo Handa
  2026-01-26  2:35         ` David Ahern
                           ` (3 more replies)
  0 siblings, 4 replies; 10+ messages in thread
From: Tetsuo Handa @ 2026-01-25 14:35 UTC (permalink / raw)
  To: Ido Schimmel, Jiri Pirko
  Cc: Breno Leitao, David S. Miller, David Ahern, Eric Dumazet,
	Jakub Kicinski, Paolo Abeni, Simon Horman, Network Development

syzbot is reporting

  unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 3
  ref_tracker: netdev@ffff88807dcf8618 has 1/2 users at
       __netdev_tracker_alloc include/linux/netdevice.h:4400 [inline]
       netdev_hold include/linux/netdevice.h:4429 [inline]
       inetdev_init+0x201/0x4e0 net/ipv4/devinet.c:286
       inetdev_event+0x251/0x1610 net/ipv4/devinet.c:1600
       notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
       call_netdevice_notifiers_mtu net/core/dev.c:2318 [inline]
       netif_set_mtu_ext+0x5aa/0x800 net/core/dev.c:9886
       netif_set_mtu+0xd7/0x1b0 net/core/dev.c:9907
       dev_set_mtu+0x126/0x260 net/core/dev_api.c:248
       team_port_del+0xb07/0xcb0 drivers/net/team/team_core.c:1333
       team_del_slave drivers/net/team/team_core.c:1936 [inline]
       team_device_event+0x207/0x5b0 drivers/net/team/team_core.c:2929
       notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
       call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
       call_netdevice_notifiers net/core/dev.c:2295 [inline]
       __dev_change_net_namespace+0xcb7/0x2050 net/core/dev.c:12592
       do_setlink+0x2ce/0x4590 net/core/rtnetlink.c:3060
       rtnl_changelink net/core/rtnetlink.c:3776 [inline]
       __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
       rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
       rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
       netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
       netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
       netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
       netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894

problem. Ido Schimmel found steps to reproduce

  ip link add name team1 type team
  ip link add name dummy1 mtu 1499 master team1 type dummy
  ip netns add ns1
  ip link set dev dummy1 netns ns1
  ip -n ns1 link del dev dummy1

and also found that the same issue was fixed in the bond driver in
commit f51048c3e07b ("bonding: avoid NETDEV_CHANGEMTU event when
unregistering slave").

Let's do similar thing for the team driver, with commit ad7c7b2172c3 ("net:
hold netdev instance lock during sysfs operations") and commit 303a8487a657
("net: s/__dev_set_mtu/__netif_set_mtu/") also applied.

Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
Suggested-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
---
 drivers/net/team/team_core.c | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
index c08a5c1bd6e4..0af2e5aa84fb 100644
--- a/drivers/net/team/team_core.c
+++ b/drivers/net/team/team_core.c
@@ -1292,7 +1292,7 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
 
 static void __team_port_change_port_removed(struct team_port *port);
 
-static int team_port_del(struct team *team, struct net_device *port_dev)
+static int team_port_del(struct team *team, struct net_device *port_dev, bool unregister)
 {
 	struct net_device *dev = team->dev;
 	struct team_port *port;
@@ -1330,7 +1330,13 @@ static int team_port_del(struct team *team, struct net_device *port_dev)
 	__team_port_change_port_removed(port);
 
 	team_port_set_orig_dev_addr(port);
-	dev_set_mtu(port_dev, port->orig.mtu);
+	if (unregister) {
+		netdev_lock_ops(port_dev);
+		__netif_set_mtu(port_dev, port->orig.mtu);
+		netdev_unlock_ops(port_dev);
+	} else {
+		dev_set_mtu(port_dev, port->orig.mtu);
+	}
 	kfree_rcu(port, rcu);
 	netdev_info(dev, "Port device %s removed\n", portname);
 	netdev_compute_master_upper_features(team->dev, true);
@@ -1634,7 +1640,7 @@ static void team_uninit(struct net_device *dev)
 	ASSERT_RTNL();
 
 	list_for_each_entry_safe(port, tmp, &team->port_list, list)
-		team_port_del(team, port->dev);
+		team_port_del(team, port->dev, false);
 
 	__team_change_mode(team, NULL); /* cleanup */
 	__team_options_unregister(team, team_options, ARRAY_SIZE(team_options));
@@ -1933,7 +1939,16 @@ static int team_del_slave(struct net_device *dev, struct net_device *port_dev)
 
 	ASSERT_RTNL();
 
-	return team_port_del(team, port_dev);
+	return team_port_del(team, port_dev, false);
+}
+
+static int team_del_slave_on_unregister(struct net_device *dev, struct net_device *port_dev)
+{
+	struct team *team = netdev_priv(dev);
+
+	ASSERT_RTNL();
+
+	return team_port_del(team, port_dev, true);
 }
 
 static netdev_features_t team_fix_features(struct net_device *dev,
@@ -2926,7 +2941,7 @@ static int team_device_event(struct notifier_block *unused,
 					       !!netif_oper_up(port->dev));
 		break;
 	case NETDEV_UNREGISTER:
-		team_del_slave(port->team->dev, dev);
+		team_del_slave_on_unregister(port->team->dev, dev);
 		break;
 	case NETDEV_FEAT_CHANGE:
 		if (!port->team->notifier_ctx) {
-- 
2.47.3



^ permalink raw reply related	[flat|nested] 10+ messages in thread

* Re: [PATCH] team: avoid NETDEV_CHANGEMTU event when unregistering slave
  2026-01-25 14:35       ` [PATCH] team: avoid NETDEV_CHANGEMTU event when unregistering slave Tetsuo Handa
@ 2026-01-26  2:35         ` David Ahern
  2026-01-26 11:08           ` Tetsuo Handa
  2026-01-27  7:38         ` Jiri Pirko
                           ` (2 subsequent siblings)
  3 siblings, 1 reply; 10+ messages in thread
From: David Ahern @ 2026-01-26  2:35 UTC (permalink / raw)
  To: Tetsuo Handa, Ido Schimmel, Jiri Pirko
  Cc: Breno Leitao, David S. Miller, Eric Dumazet, Jakub Kicinski,
	Paolo Abeni, Simon Horman, Network Development

On 1/25/26 7:35 AM, Tetsuo Handa wrote:
> syzbot is reporting
> @@ -1330,7 +1330,13 @@ static int team_port_del(struct team *team, struct net_device *port_dev)
>  	__team_port_change_port_removed(port);
>  
>  	team_port_set_orig_dev_addr(port);
> -	dev_set_mtu(port_dev, port->orig.mtu);
> +	if (unregister) {
> +		netdev_lock_ops(port_dev);
> +		__netif_set_mtu(port_dev, port->orig.mtu);
> +		netdev_unlock_ops(port_dev);
> +	} else {
> +		dev_set_mtu(port_dev, port->orig.mtu);
> +	}
>  	kfree_rcu(port, rcu);
>  	netdev_info(dev, "Port device %s removed\n", portname);
>  	netdev_compute_master_upper_features(team->dev, true);

same logic as bonding, so a netdev based helper that both drivers can use?


^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [PATCH] team: avoid NETDEV_CHANGEMTU event when unregistering slave
  2026-01-26  2:35         ` David Ahern
@ 2026-01-26 11:08           ` Tetsuo Handa
  0 siblings, 0 replies; 10+ messages in thread
From: Tetsuo Handa @ 2026-01-26 11:08 UTC (permalink / raw)
  To: David Ahern, Ido Schimmel, Jiri Pirko
  Cc: Breno Leitao, David S. Miller, Eric Dumazet, Jakub Kicinski,
	Paolo Abeni, Simon Horman, Network Development

On 2026/01/26 11:35, David Ahern wrote:
> On 1/25/26 7:35 AM, Tetsuo Handa wrote:
>> syzbot is reporting
>> @@ -1330,7 +1330,13 @@ static int team_port_del(struct team *team, struct net_device *port_dev)
>>  	__team_port_change_port_removed(port);
>>  
>>  	team_port_set_orig_dev_addr(port);
>> -	dev_set_mtu(port_dev, port->orig.mtu);
>> +	if (unregister) {
>> +		netdev_lock_ops(port_dev);
>> +		__netif_set_mtu(port_dev, port->orig.mtu);
>> +		netdev_unlock_ops(port_dev);
>> +	} else {
>> +		dev_set_mtu(port_dev, port->orig.mtu);
>> +	}
>>  	kfree_rcu(port, rcu);
>>  	netdev_info(dev, "Port device %s removed\n", portname);
>>  	netdev_compute_master_upper_features(team->dev, true);
> 
> same logic as bonding, so a netdev based helper that both drivers can use?
> 

Maybe, but that will be an another patch. No need to combine a local
bugfix patch and a multiple-users cross-modules helper patch.


^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [PATCH] team: avoid NETDEV_CHANGEMTU event when unregistering slave
  2026-01-25 14:35       ` [PATCH] team: avoid NETDEV_CHANGEMTU event when unregistering slave Tetsuo Handa
  2026-01-26  2:35         ` David Ahern
@ 2026-01-27  7:38         ` Jiri Pirko
  2026-01-27  7:42         ` Ido Schimmel
  2026-01-27 12:36         ` kernel test robot
  3 siblings, 0 replies; 10+ messages in thread
From: Jiri Pirko @ 2026-01-27  7:38 UTC (permalink / raw)
  To: Tetsuo Handa
  Cc: Ido Schimmel, Breno Leitao, David S. Miller, David Ahern,
	Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
	Network Development

Sun, Jan 25, 2026 at 03:35:28PM +0100, penguin-kernel@I-love.SAKURA.ne.jp wrote:
>syzbot is reporting
>
>  unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 3
>  ref_tracker: netdev@ffff88807dcf8618 has 1/2 users at
>       __netdev_tracker_alloc include/linux/netdevice.h:4400 [inline]
>       netdev_hold include/linux/netdevice.h:4429 [inline]
>       inetdev_init+0x201/0x4e0 net/ipv4/devinet.c:286
>       inetdev_event+0x251/0x1610 net/ipv4/devinet.c:1600
>       notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
>       call_netdevice_notifiers_mtu net/core/dev.c:2318 [inline]
>       netif_set_mtu_ext+0x5aa/0x800 net/core/dev.c:9886
>       netif_set_mtu+0xd7/0x1b0 net/core/dev.c:9907
>       dev_set_mtu+0x126/0x260 net/core/dev_api.c:248
>       team_port_del+0xb07/0xcb0 drivers/net/team/team_core.c:1333
>       team_del_slave drivers/net/team/team_core.c:1936 [inline]
>       team_device_event+0x207/0x5b0 drivers/net/team/team_core.c:2929
>       notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
>       call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
>       call_netdevice_notifiers net/core/dev.c:2295 [inline]
>       __dev_change_net_namespace+0xcb7/0x2050 net/core/dev.c:12592
>       do_setlink+0x2ce/0x4590 net/core/rtnetlink.c:3060
>       rtnl_changelink net/core/rtnetlink.c:3776 [inline]
>       __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
>       rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
>       rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
>       netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
>       netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
>       netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
>       netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
>
>problem. Ido Schimmel found steps to reproduce
>
>  ip link add name team1 type team
>  ip link add name dummy1 mtu 1499 master team1 type dummy
>  ip netns add ns1
>  ip link set dev dummy1 netns ns1
>  ip -n ns1 link del dev dummy1
>
>and also found that the same issue was fixed in the bond driver in
>commit f51048c3e07b ("bonding: avoid NETDEV_CHANGEMTU event when
>unregistering slave").
>
>Let's do similar thing for the team driver, with commit ad7c7b2172c3 ("net:
>hold netdev instance lock during sysfs operations") and commit 303a8487a657
>("net: s/__dev_set_mtu/__netif_set_mtu/") also applied.
>
>Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com
>Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
>Suggested-by: Ido Schimmel <idosch@nvidia.com>
>Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

Reviewed-by: Jiri Pirko <jiri@nvidia.com>

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: [PATCH] team: avoid NETDEV_CHANGEMTU event when unregistering slave
  2026-01-25 14:35       ` [PATCH] team: avoid NETDEV_CHANGEMTU event when unregistering slave Tetsuo Handa
  2026-01-26  2:35         ` David Ahern
  2026-01-27  7:38         ` Jiri Pirko
@ 2026-01-27  7:42         ` Ido Schimmel
  2026-01-27 12:36         ` kernel test robot
  3 siblings, 0 replies; 10+ messages in thread
From: Ido Schimmel @ 2026-01-27  7:42 UTC (permalink / raw)
  To: Tetsuo Handa
  Cc: Jiri Pirko, Breno Leitao, David S. Miller, David Ahern,
	Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
	Network Development

Patch prefix should be "[PATCH net]". See:

https://docs.kernel.org/process/maintainer-netdev.html

On Sun, Jan 25, 2026 at 11:35:28PM +0900, Tetsuo Handa wrote:

[...]

Needs a Fixes tag. AFAICT, issue was present since the beginning, so:

Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device")

> Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
> Suggested-by: Ido Schimmel <idosch@nvidia.com>
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

Doesn't build for me with CONFIG_NET_TEAM=m:

ERROR: modpost: module team uses symbol __netif_set_mtu from namespace NETDEV_INTERNAL, but does not import it.
make[2]: *** [scripts/Makefile.modpost:147: Module.symvers] Error 1
make[1]: *** [/images/share/idosch/virtme-build/Makefile:2004: modpost] Error 2
make: *** [Makefile:248: __sub-make] Error 2

Needs:

diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
index 0af2e5aa84fb..a0fe998cc055 100644
--- a/drivers/net/team/team_core.c
+++ b/drivers/net/team/team_core.c
@@ -3014,3 +3014,4 @@ MODULE_LICENSE("GPL v2");
 MODULE_AUTHOR("Jiri Pirko <jpirko@redhat.com>");
 MODULE_DESCRIPTION("Ethernet team device driver");
 MODULE_ALIAS_RTNL_LINK(DRV_NAME);
+MODULE_IMPORT_NS("NETDEV_INTERNAL");

^ permalink raw reply related	[flat|nested] 10+ messages in thread

* Re: [PATCH] team: avoid NETDEV_CHANGEMTU event when unregistering slave
  2026-01-25 14:35       ` [PATCH] team: avoid NETDEV_CHANGEMTU event when unregistering slave Tetsuo Handa
                           ` (2 preceding siblings ...)
  2026-01-27  7:42         ` Ido Schimmel
@ 2026-01-27 12:36         ` kernel test robot
  3 siblings, 0 replies; 10+ messages in thread
From: kernel test robot @ 2026-01-27 12:36 UTC (permalink / raw)
  To: Tetsuo Handa, Ido Schimmel, Jiri Pirko
  Cc: oe-kbuild-all, Breno Leitao, David Ahern, Eric Dumazet,
	Jakub Kicinski, Paolo Abeni, Simon Horman, Network Development

Hi Tetsuo,

kernel test robot noticed the following build errors:

[auto build test ERROR on linus/master]
[also build test ERROR on next-20260126]
[cannot apply to v6.16-rc1]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Tetsuo-Handa/team-avoid-NETDEV_CHANGEMTU-event-when-unregistering-slave/20260125-223816
base:   linus/master
patch link:    https://lore.kernel.org/r/ece4365f-906c-44e2-80c9-ab73f91f7fb5%40I-love.SAKURA.ne.jp
patch subject: [PATCH] team: avoid NETDEV_CHANGEMTU event when unregistering slave
config: x86_64-rhel-9.4-ltp (https://download.01.org/0day-ci/archive/20260127/202601271353.GO9xxwpb-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260127/202601271353.GO9xxwpb-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202601271353.GO9xxwpb-lkp@intel.com/

All errors (new ones prefixed by >>, old ones prefixed by <<):

>> ERROR: modpost: module team uses symbol __netif_set_mtu from namespace NETDEV_INTERNAL, but does not import it.

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

^ permalink raw reply	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2026-01-27 12:36 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-01-25  5:11 [PATCH] ipv4: don't call inetdev_init() if device is no longer registered Tetsuo Handa
2026-01-25  8:58 ` Ido Schimmel
2026-01-25 11:21   ` Tetsuo Handa
2026-01-25 12:15     ` Ido Schimmel
2026-01-25 14:35       ` [PATCH] team: avoid NETDEV_CHANGEMTU event when unregistering slave Tetsuo Handa
2026-01-26  2:35         ` David Ahern
2026-01-26 11:08           ` Tetsuo Handa
2026-01-27  7:38         ` Jiri Pirko
2026-01-27  7:42         ` Ido Schimmel
2026-01-27 12:36         ` kernel test robot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox