Re: [PATCH net] vrf: Fix a potential NPD when removing a port from a VRF

[David Ahern <dsahern@kernel.org>]

On 4/23/26 12:36 AM, Ido Schimmel wrote:
> RCU readers that identified a net device as a VRF port using
> netif_is_l3_slave() assume that a subsequent call to
> netdev_master_upper_dev_get_rcu() will return a VRF device. They then
> continue to dereference its l3mdev operations.
> 
> This assumption is not always correct and can result in a NPD [1]. There
> is no RCU synchronization when removing a port from a VRF, so it is
> possible for an RCU reader to see a new master device (e.g., a bridge)
> that does not have l3mdev operations.
> 
> Fix by adding RCU synchronization after clearing the IFF_L3MDEV_SLAVE
> flag. Skip this synchronization when a net device is removed from a VRF
> as part of its deletion and when the VRF device itself is deleted. In
> the latter case an RCU grace period will pass by the time RTNL is
> released.
> 
> [1]
> BUG: kernel NULL pointer dereference, address: 0000000000000000
> [...]
> RIP: 0010:l3mdev_fib_table_rcu (net/l3mdev/l3mdev.c:181)
> [...]
> Call Trace:
> <TASK>
> l3mdev_fib_table_by_index (net/l3mdev/l3mdev.c:201 net/l3mdev/l3mdev.c:189)
> __inet_bind (net/ipv4/af_inet.c:499 (discriminator 3))
> inet_bind_sk (net/ipv4/af_inet.c:469)
> __sys_bind (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:1951 (discriminator 1))
> __x64_sys_bind (net/socket.c:1969 (discriminator 1) net/socket.c:1967 (discriminator 1) net/socket.c:1967 (discriminator 1))
> do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))
> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
> 
> Fixes: fdeea7be88b1 ("net: vrf: Set slave's private flag before linking")
> Reported-by: Haoze Xie <royenheart@gmail.com>
> Reported-by: Yifan Wu <yifanwucs@gmail.com>
> Reported-by: Juefei Pu <tomapufckgml@gmail.com>
> Reported-by: Yuan Tan <yuantan098@gmail.com>
> Closes: https://lore.kernel.org/netdev/20260419145332.3988923-1-n05ec@lzu.edu.cn/
> Signed-off-by: Ido Schimmel <idosch@nvidia.com>
> ---
>  drivers/net/vrf.c | 15 +++++++++++----
>  1 file changed, 11 insertions(+), 4 deletions(-)
> 

Reviewed-by: David Ahern <dsahern@kernel.org>