From: Ren Wei <weir@nebusec.ai>
To: netdev@vger.kernel.org
Cc: jiri@resnulli.us, davem@davemloft.net, edumazet@kernel.org,
kuba@kernel.org, pabeni@redhat.com, horms@kernel.org,
vega@nebusec.ai, petalzu987@gmail.com, weir@nebusec.ai
Subject: [PATCH net 0/1] net: devlink: fix reload error on netns teardown
Date: Sun, 4 Oct 2026 02:14:41 +0800 [thread overview]
Message-ID: <cover.1791019703.git.petalzu987@gmail.com> (raw)
From: Zixuan Chai <petalzu987@gmail.com>
Hi Linux kernel maintainers,
We found an issue in net/devlink/dev.c.
This bug is tracked at: https://bugtracker.nebusec.ai/f/11365
When a supported driver's reload_down callback fails,
devlink_pernet_pre_exit() merely warns and leaves the registered devlink in
the namespace being destroyed. devlink->_net is a non-refcounted
possible_net_t pointer, so cleanup_net() subsequently frees that namespace
while the devlink remains globally registered and operational. Later
notifications dereference the stale pointer through genl_has_listeners()
and multicast helpers, causing a network-namespace UAF; slab reuse can also
make the devlink appear to belong to an unrelated newly created namespace.
The reproducer uses netdevsim and requires root in the initial namespace.
Reproducer:
#!/bin/sh
set -eux
ID="${1:-10}"
NS="${2:-testns1}"
SYSFS_BASE="/sys/bus/netdevsim"
DEV_NAME="netdevsim${ID}"
DL_HANDLE="netdevsim/${DEV_NAME}"
DEBUGFS_DIR="/sys/kernel/debug/netdevsim/${DEV_NAME}"
mountpoint -q /sys/kernel/debug || mount -t debugfs none /sys/kernel/debug
printf 0 > /proc/sys/kernel/panic_on_warn
ip netns del "${NS}" 2>/dev/null || true
[ ! -e "${SYSFS_BASE}/devices/${DEV_NAME}" ] || echo "${ID}" > "${SYSFS_BASE}/del_device"
ip netns add "${NS}"
echo "${ID} 1" > "${SYSFS_BASE}/new_device"
for _ in $(seq 1 50); do
[ -d "${DEBUGFS_DIR}" ] && break
sleep 0.1
done
devlink dev reload "${DL_HANDLE}" netns "${NS}"
devlink -N "${NS}" dev show "${DL_HANDLE}" >/dev/null
# Force reload_down() to fail during namespace teardown.
echo y > "${DEBUGFS_DIR}/dont_allow_reload"
ip netns del "${NS}"
sleep 1
# Trigger a later devlink notification on the still-registered instance.
echo "${ID}" > "${SYSFS_BASE}/del_device"
sleep 1
We run the PoC in a 2 vCPU, 2 GB RAM x86 QEMU environment.
------BEGIN PoC------
#!/bin/sh
set -eux
ID="${1:-10}"
NS="${2:-testns1}"
SYSFS_BASE="/sys/bus/netdevsim"
DEV_NAME="netdevsim${ID}"
DL_HANDLE="netdevsim/${DEV_NAME}"
DEBUGFS_DIR="/sys/kernel/debug/netdevsim/${DEV_NAME}"
mountpoint -q /sys/kernel/debug || mount -t debugfs none /sys/kernel/debug
printf 0 > /proc/sys/kernel/panic_on_warn
ip netns del "${NS}" 2>/dev/null || true
[ ! -e "${SYSFS_BASE}/devices/${DEV_NAME}" ] || echo "${ID}" > "${SYSFS_BASE}/del_device"
ip netns add "${NS}"
echo "${ID} 1" > "${SYSFS_BASE}/new_device"
for _ in $(seq 1 50); do
[ -d "${DEBUGFS_DIR}" ] && break
sleep 0.1
done
devlink dev reload "${DL_HANDLE}" netns "${NS}"
devlink -N "${NS}" dev show "${DL_HANDLE}" >/dev/null
# Force reload_down() to fail during namespace teardown.
echo y > "${DEBUGFS_DIR}/dont_allow_reload"
ip netns del "${NS}"
sleep 1
# Trigger a later devlink notification on the still-registered instance.
echo "${ID}" > "${SYSFS_BASE}/del_device"
sleep 1
------END PoC--------
----BEGIN crash log----
[ 269.280912][ T9298] BUG: KASAN: null-ptr-deref in netlink_has_listeners+0x2a/0x430
[ 269.281030][ T9298] Read of size 8 at addr 0000000000000578 by task bash/9298
[ 269.281063][ T9298]
[ 269.281081][ T9298] CPU: 0 UID: 0 PID: 9298 Comm: bash Not tainted 7.3.0-rc5-00170-g6dc989ea46b9 #2 PREEMPT(full)
[ 269.281131][ T9298] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[ 269.281155][ T9298] Call Trace:
[ 269.281170][ T9298] <TASK>
[ 269.281187][ T9298] dump_stack_lvl+0x116/0x1b0
[ 269.281249][ T9298] ? netlink_has_listeners+0x2a/0x430
[ 269.281288][ T9298] kasan_report+0xca/0x100
[ 269.281339][ T9298] ? netlink_has_listeners+0x2a/0x430
[ 269.281386][ T9298] kasan_check_range+0x39/0x1c0
[ 269.281443][ T9298] netlink_has_listeners+0x2a/0x430
[ 269.281485][ T9298] devlink_port_notify+0x1fc/0x4f0
[ 269.281542][ T9298] ? __pfx_devlink_port_notify+0x10/0x10
[ 269.281597][ T9298] ? lock_acquire+0x1bf/0x370
[ 269.281642][ T9298] ? find_held_lock+0x2b/0x80
[ 269.281701][ T9298] ? __local_bh_enable_ip+0xab/0x130
[ 269.281769][ T9298] ? __devlink_port_type_set+0x1e1/0x700
[ 269.281823][ T9298] __devlink_port_type_set+0x1e1/0x700
[ 269.281880][ T9298] ? __pfx___devlink_port_type_set+0x10/0x10
[ 269.281956][ T9298] ? ip_vs_dst_event+0x5e0/0xdd0
[ 269.282021][ T9298] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 269.282077][ T9298] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 269.282130][ T9298] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 269.282188][ T9298] devlink_port_netdevice_event+0x12d/0x260
[ 269.282253][ T9298] notifier_call_chain+0xbd/0x430
[ 269.282307][ T9298] ? __pfx_devlink_port_netdevice_event+0x10/0x10
[ 269.282375][ T9298] call_netdevice_notifiers_info+0xbe/0x110
[ 269.282437][ T9298] unregister_netdevice_many_notify+0xe09/0x2130
[ 269.282500][ T9298] ? __pfx_unregister_netdevice_many_notify+0x10/0x10
[ 269.282560][ T9298] ? __pfx___mutex_lock+0x10/0x10
[ 269.282628][ T9298] unregister_netdevice_queue+0x305/0x3c0
[ 269.282681][ T9298] ? _raw_spin_unlock_irqrestore+0x41/0x70
[ 269.282737][ T9298] ? __pfx_unregister_netdevice_queue+0x10/0x10
[ 269.282799][ T9298] nsim_destroy+0x239/0x990
[ 269.282841][ T9298] __nsim_dev_port_del+0x197/0x2c0
[ 269.282887][ T9298] nsim_dev_reload_destroy+0x105/0x480
[ 269.282940][ T9298] nsim_drv_remove+0x52/0x1e0
[ 269.282986][ T9298] ? __pfx_nsim_bus_remove+0x10/0x10
[ 269.283046][ T9298] device_remove+0xcb/0x170
[ 269.283125][ T9298] device_release_driver_internal+0x45e/0x630
[ 269.283176][ T9298] bus_remove_device+0x2ba/0x570
[ 269.283238][ T9298] ? __pfx_bus_remove_device+0x10/0x10
[ 269.283298][ T9298] ? __pfx_device_remove_attrs+0x10/0x10
[ 269.283357][ T9298] device_del+0x396/0x9d0
[ 269.283422][ T9298] ? __pfx_device_del+0x10/0x10
[ 269.283493][ T9298] device_unregister+0x1e/0xf0
[ 269.283558][ T9298] del_device_store+0x34c/0x4b0
[ 269.283618][ T9298] ? __pfx_del_device_store+0x10/0x10
[ 269.283679][ T9298] ? sysfs_file_kobj+0xe6/0x2a0
[ 269.283739][ T9298] ? __pfx_del_device_store+0x10/0x10
[ 269.283799][ T9298] bus_attr_store+0x74/0xb0
[ 269.283849][ T9298] ? __pfx_bus_attr_store+0x10/0x10
[ 269.283900][ T9298] sysfs_kf_write+0xef/0x150
[ 269.283960][ T9298] ? __pfx_sysfs_kf_write+0x10/0x10
[ 269.284019][ T9298] kernfs_fop_write_iter+0x397/0x580
[ 269.284075][ T9298] vfs_write+0xc1f/0x1150
[ 269.284120][ T9298] ? __pfx_kernfs_fop_write_iter+0x10/0x10
[ 269.284177][ T9298] ? __pfx_vfs_write+0x10/0x10
[ 269.284235][ T9298] ksys_write+0x121/0x240
[ 269.284279][ T9298] ? __pfx_ksys_write+0x10/0x10
[ 269.284330][ T9298] do_syscall_64+0x128/0x7b0
[ 269.284390][ T9298] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 269.284433][ T9298] RIP: 0033:0x7fbbdff95513
[ 269.284466][ T9298] Code: 8b 15 81 29 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 48 89 54 24 18
[ 269.284507][ T9298] RSP: 002b:00007fff38e00658 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 269.284550][ T9298] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fbbdff95513
[ 269.284578][ T9298] RDX: 0000000000000003 RSI: 000055c92189ac40 RDI: 0000000000000001
[ 269.284604][ T9298] RBP: 000055c92189ac40 R08: 000000000000000a R09: 00007fbbe00390c0
[ 269.284631][ T9298] R10: 00007fbbe0038fc0 R11: 0000000000000246 R12: 0000000000000003
[ 269.284657][ T9298] R13: 00007fbbe00796a0 R14: 0000000000000003 R15: 00007fbbe0074880
[ 269.284696][ T9298] </TASK>
[ 269.284711][ T9298] ==================================================================
[ 269.284729][ T9298] Disabling lock debugging due to kernel taint
[ 269.284782][ T9298] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000af: 0000 [#1] SMP KASAN NOPTI
[ 269.358328][ T9298] KASAN: null-ptr-deref in range [0x0000000000000578-0x000000000000057f]
[ 269.359159][ T9298] CPU: 0 UID: 0 PID: 9298 Comm: bash Tainted: G B 7.3.0-rc5-00170-g6dc989ea46b9 #2 PREEMPT(full)
[ 269.360348][ T9298] Tainted: [B]=BAD_PAGE
[ 269.360765][ T9298] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[ 269.361664][ T9298] RIP: 0010:netlink_has_listeners+0x3b/0x430
[ 269.362277][ T9298] Code: 4c 8d a3 78 05 00 00 e8 e3 7a 14 f8 be 08 00 00 00 4c 89 e7 e8 96 a8 85 f8 4c 89 e2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 d4 03 00 00 4c 8b a3 78 05 00 00 31 ff 41 83 e4
[ 269.364115][ T9298] RSP: 0018:ffa00000054f7430 EFLAGS: 00010206
[ 269.364703][ T9298] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 269.365463][ T9298] RDX: 00000000000000af RSI: ffffffff82331e9b RDI: 0000000000000007
[ 269.366221][ T9298] RBP: 0000000000000009 R08: 0000000000000000 R09: fffffbfff287eae0
[ 269.366960][ T9298] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000578
[ 269.367702][ T9298] R13: ff11000025516800 R14: 0000000000000007 R15: ff1100004c62a880
[ 269.368426][ T9298] FS: 00007fbbdfea7740(0000) GS:ff110000d5672000(0000) knlGS:0000000000000000
[ 269.369245][ T9298] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 269.369863][ T9298] CR2: 000055c911370020 CR3: 0000000038e41000 CR4: 0000000000753ef0
[ 269.370602][ T9298] PKRU: 55555554
[ 269.370933][ T9298] Call Trace:
[ 269.371240][ T9298] <TASK>
[ 269.371505][ T9298] devlink_port_notify+0x1fc/0x4f0
[ 269.371973][ T9298] ? __pfx_devlink_port_notify+0x10/0x10
[ 269.372483][ T9298] ? lock_acquire+0x1bf/0x370
[ 269.372915][ T9298] ? find_held_lock+0x2b/0x80
[ 269.373349][ T9298] ? __local_bh_enable_ip+0xab/0x130
[ 269.373836][ T9298] ? __devlink_port_type_set+0x1e1/0x700
[ 269.374351][ T9298] __devlink_port_type_set+0x1e1/0x700
[ 269.374855][ T9298] ? __pfx___devlink_port_type_set+0x10/0x10
[ 269.375396][ T9298] ? ip_vs_dst_event+0x5e0/0xdd0
[ 269.375846][ T9298] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 269.376389][ T9298] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 269.376926][ T9298] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 269.377466][ T9298] devlink_port_netdevice_event+0x12d/0x260
[ 269.378017][ T9298] notifier_call_chain+0xbd/0x430
[ 269.378478][ T9298] ? __pfx_devlink_port_netdevice_event+0x10/0x10
[ 269.379065][ T9298] call_netdevice_notifiers_info+0xbe/0x110
[ 269.379613][ T9298] unregister_netdevice_many_notify+0xe09/0x2130
[ 269.380182][ T9298] ? __pfx_unregister_netdevice_many_notify+0x10/0x10
[ 269.380790][ T9298] ? __pfx___mutex_lock+0x10/0x10
[ 269.381259][ T9298] unregister_netdevice_queue+0x305/0x3c0
[ 269.381767][ T9298] ? _raw_spin_unlock_irqrestore+0x41/0x70
[ 269.382302][ T9298] ? __pfx_unregister_netdevice_queue+0x10/0x10
[ 269.382865][ T9298] nsim_destroy+0x239/0x990
[ 269.383288][ T9298] __nsim_dev_port_del+0x197/0x2c0
[ 269.383751][ T9298] nsim_dev_reload_destroy+0x105/0x480
[ 269.384252][ T9298] nsim_drv_remove+0x52/0x1e0
[ 269.384685][ T9298] ? __pfx_nsim_bus_remove+0x10/0x10
[ 269.385177][ T9298] device_remove+0xcb/0x170
[ 269.385601][ T9298] device_release_driver_internal+0x45e/0x630
[ 269.386158][ T9298] bus_remove_device+0x2ba/0x570
[ 269.386611][ T9298] ? __pfx_bus_remove_device+0x10/0x10
[ 269.387119][ T9298] ? __pfx_device_remove_attrs+0x10/0x10
[ 269.387632][ T9298] device_del+0x396/0x9d0
[ 269.388035][ T9298] ? __pfx_device_del+0x10/0x10
[ 269.388481][ T9298] device_unregister+0x1e/0xf0
[ 269.388919][ T9298] del_device_store+0x34c/0x4b0
[ 269.389367][ T9298] ? __pfx_del_device_store+0x10/0x10
[ 269.389858][ T9298] ? sysfs_file_kobj+0xe6/0x2a0
[ 269.390313][ T9298] ? __pfx_del_device_store+0x10/0x10
[ 269.390799][ T9298] bus_attr_store+0x74/0xb0
[ 269.391215][ T9298] ? __pfx_bus_attr_store+0x10/0x10
[ 269.391694][ T9298] sysfs_kf_write+0xef/0x150
[ 269.392125][ T9298] ? __pfx_sysfs_kf_write+0x10/0x10
[ 269.392593][ T9298] kernfs_fop_write_iter+0x397/0x580
[ 269.393087][ T9298] vfs_write+0xc1f/0x1150
[ 269.393480][ T9298] ? __pfx_kernfs_fop_write_iter+0x10/0x10
[ 269.394022][ T9298] ? __pfx_vfs_write+0x10/0x10
[ 269.394464][ T9298] ksys_write+0x121/0x240
[ 269.394859][ T9298] ? __pfx_ksys_write+0x10/0x10
[ 269.395312][ T9298] do_syscall_64+0x128/0x7b0
[ 269.395747][ T9298] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 269.396289][ T9298] RIP: 0033:0x7fbbdff95513
[ 269.396683][ T9298] Code: 8b 15 81 29 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 48 89 54 24 18
[ 269.398393][ T9298] RSP: 002b:00007fff38e00658 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 269.399135][ T9298] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fbbdff95513
[ 269.399826][ T9298] RDX: 0000000000000003 RSI: 000055c92189ac40 RDI: 0000000000000001
[ 269.400512][ T9298] RBP: 000055c92189ac40 R08: 000000000000000a R09: 00007fbbe00390c0
[ 269.401205][ T9298] R10: 00007fbbe0038fc0 R11: 0000000000000246 R12: 0000000000000003
[ 269.401904][ T9298] R13: 00007fbbe00796a0 R14: 0000000000000003 R15: 00007fbbe0074880
[ 269.402606][ T9298] </TASK>
[ 269.402887][ T9298] Modules linked in:
[ 269.403324][ T9298] ---[ end trace 0000000000000000 ]---
[ 269.403835][ T9298] RIP: 0010:netlink_has_listeners+0x3b/0x430
[ 269.403849][ T9298] Code: 4c 8d a3 78 05 00 00 e8 e3 7a 14 f8 be 08 00 00 00 4c 89 e7 e8 96 a8 85 f8 4c 89 e2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 d4 03 00 00 4c 8b a3 78 05 00 00 31 ff 41 83 e4
[ 269.403860][ T9298] RSP: 0018:ffa00000054f7430 EFLAGS: 00010206
[ 269.403870][ T9298] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 269.403877][ T9298] RDX: 00000000000000af RSI: ffffffff82331e9b RDI: 0000000000000007
[ 269.403885][ T9298] RBP: 0000000000000009 R08: 0000000000000000 R09: fffffbfff287eae0
[ 269.403894][ T9298] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000578
[ 269.403902][ T9298] R13: ff11000025516800 R14: 0000000000000007 R15: ff1100004c62a880
[ 269.403909][ T9298] FS: 00007fbbdfea7740(0000) GS:ff110000d5672000(0000) knlGS:0000000000000000
[ 269.403921][ T9298] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 269.403929][ T9298] CR2: 000055c911370020 CR3: 0000000038e41000 CR4: 0000000000753ef0
[ 269.403937][ T9298] PKRU: 55555554
[ 269.403943][ T9298] Kernel panic - not syncing: Fatal exception
[ 269.413401][ T9298] Kernel Offset: disabled
[ 269.413789][ T9298] Rebooting in 86400 seconds..
-----END crash log-----
Best regards,
Zixuan Chai
Zixuan Chai (1):
net: devlink: handle reload failure during netns teardown
net/devlink/dev.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
base-commit: 6dc989ea46b96ce170840174b4a38c4a387fb005
--
2.34.1
next reply other threads:[~2026-10-03 18:14 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-03 18:14 Ren Wei [this message]
2026-10-03 18:14 ` [PATCH net 1/1] net: devlink: fix reload error on netns teardown Ren Wei
2026-10-09 1:51 ` Jakub Kicinski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cover.1791019703.git.petalzu987@gmail.com \
--to=weir@nebusec.ai \
--cc=davem@davemloft.net \
--cc=edumazet@kernel.org \
--cc=horms@kernel.org \
--cc=jiri@resnulli.us \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=petalzu987@gmail.com \
--cc=vega@nebusec.ai \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox