Re: [PATCH net] net: hsr: clean up the slave VLAN filters when deleting a port

[Jiayuan Chen <jiayuan.chen@linux.dev>]

On 7/14/26 7:07 PM, Felix Maurer wrote:
> On Tue, Jul 14, 2026 at 04:06:36PM +0800, Jiayuan Chen wrote:
>> Our internal syzkaller reported this warning:
>>
>>    netdevsim netdevsim10 eth0: entered promiscuous mode
>>    netdevsim netdevsim10 eth1: entered promiscuous mode
>>    netdevsim netdevsim10 eth1 (unregistering): left promiscuous mode
>>    ------------[ cut here ]------------
>>    WARNING: drivers/net/netdevsim/netdev.c:1208 at nsim_destroy+0x276/0x6e0, CPU#3: 1/46
>>    Modules linked in:
>>    CPU: 3 UID: 0 PID: 46 Comm: kworker/u16:1 Not tainted 7.2.0-rc2+ #286 PREEMPT
>>    Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
>>    Workqueue: netns cleanup_net
>>    RIP: 0010:nsim_destroy (drivers/net/netdevsim/netdev.c:1031 drivers/net/netdevsim/netdev.c:1201)
>>    RSP: 0018:ffffc90000337898 EFLAGS: 00010293
>>    RAX: 0000000000000001 RBX: ffff8881036c8b00 RCX: 0000000000000000
>>    RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
>>    RBP: ffffc900003378f0 R08: 0000000000000000 R09: 0000000000000000
>>    R10: ffffffffad4186a8 R11: ffffffffad41c3db R12: ffff8881036c9268
>>    R13: dffffc0000000000 R14: ffffed10206d9164 R15: 0000000000000001
>>    FS:  0000000000000000(0000) GS:ffff888160866000(0000) knlGS:0000000000000000
>>    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>    CR2: 000055bcf1a2e0c4 CR3: 0000000105376003 CR4: 0000000000770ef0
>>    PKRU: 55555554
>>    Call Trace:
>>    <TASK>
>>    __nsim_dev_port_del (drivers/net/netdevsim/dev.c:1547)
>>    nsim_dev_reload_destroy (drivers/net/netdevsim/dev.c:1561 drivers/net/netdevsim/dev.c:1785)
>>    nsim_dev_reload_down (drivers/net/netdevsim/dev.c:1038)
>>    devlink_reload (net/devlink/dev.c:462)
>>    devlink_pernet_pre_exit (net/devlink/core.c:578)
>>    ops_undo_list (net/core/net_namespace.c:161 net/core/net_namespace.c:235)
>>    cleanup_net (net/core/net_namespace.c:706)
>>    process_one_work (kernel/workqueue.c:3322)
>>    worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)
>>    kthread (kernel/kthread.c:436)
>>    ret_from_fork (arch/x86/kernel/process.c:158)
>>    ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
>>    </TASK>
>>    ---[ end trace 0000000000000000 ]---
>>    netdevsim netdevsim10 eth0 (unregistering): left promiscuous mode
>>
>> vlan_vids_add_by_dev() is what passes the VID filter info down to the real
>> device. A virtual device does no filtering itself, so it has to push the
>> VIDs down to its slaves. HSR already does this correctly on the add side:
>> hsr_ndo_vlan_rx_add_vid() calls vlan_vid_add() on each slave.
>>
>> We just never clean the slaves up on delete. hsr_del_port() drops the port
>> and leaves the VIDs sitting on the slave, so the filter entries leak.
>> netdevsim keeps a bitmap of the VIDs it was told to filter and checks that
>> it is empty when the netdev goes away, which is what trips the warning
>> above.
>>
>> So do the cleanup in hsr_del_port(). We follow hsr_ndo_vlan_rx_add_vid()
>> here: it only pushes the VIDs to HSR_PT_SLAVE_A and HSR_PT_SLAVE_B, so the
>> del side only touches those two as well.
>>
>> Reproducer:
>> ip netns add ns0
>> ip netns exec ns0 sh -c 'echo "10 2" > /sys/bus/netdevsim/new_device'
>> ip netns exec ns0 ip link add hsr0 type hsr slave1 eth0 slave2 eth1
>> ip netns exec ns0 ip link add link hsr0 name hsr0.1 type vlan id 1
>> ip netns del ns0
> Thank you for your patch! The explanation and the patch look very
> similar to a fix that Eric posted a week ago [1]. Can you check if
> Eric's patch also fixes you reproducer? And if it does, please add your
> Tested-by and/or Reviewed-by to the thread?
>
> Thanks,
>     Felix
>
>
> [1]: https://lore.kernel.org/netdev/20260707082327.3238690-1-edumazet@google.com/


Thanks, It seems my patch is duplicated.