Re: [PATCH net v3 0/2] team: Fix reference count leak when changing port netns

[Stanislav Fomichev <stfomichev@gmail.com>]

On 02/24, Ido Schimmel wrote:
> Patch #1 fixes a reference count leak that was reported by syzkaller.
> The leak happens when a net device that is member in a team is changing
> netns. The fix is to align the team driver with the bond driver and have
> it suppress NETDEV_CHANGEMTU events for a net device that is being
> unregistered.
> 
> Without this change, the NETDEV_CHANGEMTU event causes inetdev_event()
> to recreate an inet device for this net device in its original netns,
> after it was previously destroyed upon NETDEV_UNREGISTER. Later on, when
> inetdev_event() receives a NETDEV_REGISTER event for this net device in
> the new nents, it simply leaks the reference:
> 
> case NETDEV_REGISTER:
>         pr_debug("%s: bug\n", __func__);
>         RCU_INIT_POINTER(dev->ip_ptr, NULL);
>         break;
> 
> addrconf_notify() handles this differently and reuses the existing inet6
> device if one exists when a NETDEV_REGISTER event is received. This
> creates a different problem where it is possible for a net device to
> reference an inet6 device that was created in a previous netns.
> 
> A more generic fix that we can try in net-next is to revert the changes
> in the bond and team drivers and instead have IPv4 and IPv6 destroy and
> recreate an inet device if one already exists upon NETDEV_REGISTER.
> 
> Patch #2 adds a selftest that passes with the fix and hangs without it.
> 
> v3:
>   - Add a selftest.

Acked-by: Stanislav Fomichev <sdf@fomichev.me>

Thanks!