public inbox for netdev@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH net v3 0/2] team: Fix reference count leak when changing port netns
@ 2026-02-24 12:57 Ido Schimmel
  2026-02-24 12:57 ` [PATCH net v3 1/2] team: avoid NETDEV_CHANGEMTU event when unregistering slave Ido Schimmel
                   ` (3 more replies)
  0 siblings, 4 replies; 6+ messages in thread
From: Ido Schimmel @ 2026-02-24 12:57 UTC (permalink / raw)
  To: netdev
  Cc: davem, kuba, pabeni, edumazet, jiri, andrew+netdev,
	penguin-kernel, stfomichev, Ido Schimmel

Patch #1 fixes a reference count leak that was reported by syzkaller.
The leak happens when a net device that is member in a team is changing
netns. The fix is to align the team driver with the bond driver and have
it suppress NETDEV_CHANGEMTU events for a net device that is being
unregistered.

Without this change, the NETDEV_CHANGEMTU event causes inetdev_event()
to recreate an inet device for this net device in its original netns,
after it was previously destroyed upon NETDEV_UNREGISTER. Later on, when
inetdev_event() receives a NETDEV_REGISTER event for this net device in
the new nents, it simply leaks the reference:

case NETDEV_REGISTER:
        pr_debug("%s: bug\n", __func__);
        RCU_INIT_POINTER(dev->ip_ptr, NULL);
        break;

addrconf_notify() handles this differently and reuses the existing inet6
device if one exists when a NETDEV_REGISTER event is received. This
creates a different problem where it is possible for a net device to
reference an inet6 device that was created in a previous netns.

A more generic fix that we can try in net-next is to revert the changes
in the bond and team drivers and instead have IPv4 and IPv6 destroy and
recreate an inet device if one already exists upon NETDEV_REGISTER.

Patch #2 adds a selftest that passes with the fix and hangs without it.

v3:
  - Add a selftest.
v2: https://lore.kernel.org/netdev/4d69abe1-ca8d-4f0b-bcf8-13899b211e57@I-love.SAKURA.ne.jp/
  - Add Fixes tag.
  - Add MODULE_IMPORT_NS().
v1: https://lore.kernel.org/all/ece4365f-906c-44e2-80c9-ab73f91f7fb5@I-love.SAKURA.ne.jp/

Ido Schimmel (1):
  selftests: team: Add a reference count leak test

Tetsuo Handa (1):
  team: avoid NETDEV_CHANGEMTU event when unregistering slave

 drivers/net/team/team_core.c                  | 26 +++++++++++++++----
 .../selftests/drivers/net/team/Makefile       |  1 +
 .../selftests/drivers/net/team/refleak.sh     | 17 ++++++++++++
 3 files changed, 39 insertions(+), 5 deletions(-)
 create mode 100755 tools/testing/selftests/drivers/net/team/refleak.sh

-- 
2.53.0


^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-02-26  3:20 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-24 12:57 [PATCH net v3 0/2] team: Fix reference count leak when changing port netns Ido Schimmel
2026-02-24 12:57 ` [PATCH net v3 1/2] team: avoid NETDEV_CHANGEMTU event when unregistering slave Ido Schimmel
2026-02-24 12:57 ` [PATCH net v3 2/2] selftests: team: Add a reference count leak test Ido Schimmel
2026-02-24 14:43   ` Jiri Pirko
2026-02-25  1:33 ` [PATCH net v3 0/2] team: Fix reference count leak when changing port netns Stanislav Fomichev
2026-02-26  3:20 ` patchwork-bot+netdevbpf

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox