From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from dvalin.narfation.org (dvalin.narfation.org [213.160.73.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6FA3E403EAF for ; Mon, 20 Jul 2026 13:52:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=213.160.73.56 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784555537; cv=none; b=HJFfOSbSdm31goI8u69Z8xEwID+wW91A79v9dPj1sOCyKFBD6wi9ONR6rSM7rh4aL8xeU8A+sKTCnP+aK4E93NrnKW4hi0ps9WlsEDBM2P/J5Q+KIYS+ZrfH2JBm7at6SYAo8jqQmkrEj/8vtqmx1zrCc9FnuMqRQxVe3TDS8QM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784555537; c=relaxed/simple; bh=PHrgY1ZqXTpY4BgPjkDJpFnA3D+++qrBLDoWm1SJhY4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=VjxoScrmA22s8AIL0TBAQ6ZLeWBD1R9034eZr2bqfTD/pybetSHbOWtaNrY8ocRbMnAT/pxDWrMl2GITbAonT69Cd0zCIMYdbT0IEZMJGPV6fnIVA8YIZp2qgeTIJIRuoTZBYGBW3sDJczaKCZWOQJZ39IPcRo8wrUL72wFuUg0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=narfation.org; spf=pass smtp.mailfrom=narfation.org; dkim=pass (1024-bit key) header.d=narfation.org header.i=@narfation.org header.b=vS4cGA48; arc=none smtp.client-ip=213.160.73.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=narfation.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=narfation.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=narfation.org header.i=@narfation.org header.b="vS4cGA48" Received: by dvalin.narfation.org (Postfix) id 06F5F20267; Mon, 20 Jul 2026 13:52:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=narfation.org; s=20121; t=1784555533; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=SfygAqBUswZp+kNTVS7278NdSOiMOHA75Kns629VEGc=; b=vS4cGA48Zppzw/fzxPg3NNH2lk+P6hn9l5AK03aKK7zVnIWW3njXDNOAF3viX/tnFlTZ+g rT/t95aymqodMLc7nDN9h0KLkJSe3jLdodHE3eUwjr59DECharaD8fWbfEubtjz8rKKB9b GBFYaGl3Flon4Oas1MEs1d35/5qf1H0= From: Sven Eckelmann To: stable@vger.kernel.org Cc: Sven Eckelmann Subject: [PATCH 6.1.y] batman-adv: clean untagged VLAN on netdev registration failure Date: Mon, 20 Jul 2026 15:52:01 +0200 Message-ID: <20260720135201.770886-1-sven@narfation.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <2026072026-starboard-problem-44f9@gregkh> References: <2026072026-starboard-problem-44f9@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit commit 8669a550c752d86baebc5fdc83b8ff35c4372c0e upstream. When an mesh interface is registered, it creates an untagged struct batadv_meshif_vlan on top of it via the NETDEV_REGISTER notifier. But in this process, another receiver of this notification can veto the registration. The netdev registration will be aborted because of this veto. The register_netdevice() call will try to clean up the net_device using unregister_netdevice_queue() - which only uses the .priv_destructor to free private resources. In this situation, .dellink will not be called. The cleanup of the untagged batadv_meshif_vlan must thefore be done in the destructor to avoid a leak of this object. Cc: stable@vger.kernel.org Fixes: 5d2c05b21337 ("batman-adv: add per VLAN interface attribute framework") [ switch to old "mesh_iface" name "soft_iface" ] Signed-off-by: Sven Eckelmann --- net/batman-adv/main.c | 8 ++++++++ net/batman-adv/soft-interface.c | 13 ++----------- net/batman-adv/soft-interface.h | 2 ++ 3 files changed, 12 insertions(+), 11 deletions(-) diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c index 18b32c39ed4bc..2d2dabbcbb502 100644 --- a/net/batman-adv/main.c +++ b/net/batman-adv/main.c @@ -258,6 +258,7 @@ int batadv_mesh_init(struct net_device *soft_iface) void batadv_mesh_free(struct net_device *soft_iface) { struct batadv_priv *bat_priv = netdev_priv(soft_iface); + struct batadv_softif_vlan *vlan; atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); @@ -273,6 +274,13 @@ void batadv_mesh_free(struct net_device *soft_iface) batadv_mcast_free(bat_priv); + /* destroy the "untagged" VLAN */ + vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS); + if (vlan) { + batadv_softif_destroy_vlan(bat_priv, vlan); + batadv_softif_vlan_put(vlan); + } + /* Free the TT and the originator tables only after having terminated * all the other depending components which may use these structures for * their purposes. diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c index c0549abcae7a6..d3ab65c9bdaa3 100644 --- a/net/batman-adv/soft-interface.c +++ b/net/batman-adv/soft-interface.c @@ -601,8 +601,8 @@ int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid) * @bat_priv: the bat priv with all the soft interface information * @vlan: the object to remove */ -static void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv, - struct batadv_softif_vlan *vlan) +void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv, + struct batadv_softif_vlan *vlan) { /* explicitly remove the associated TT local entry because it is marked * with the NOPURGE flag @@ -1084,22 +1084,13 @@ static int batadv_softif_newlink(struct net *src_net, struct net_device *dev, static void batadv_softif_destroy_netlink(struct net_device *soft_iface, struct list_head *head) { - struct batadv_priv *bat_priv = netdev_priv(soft_iface); struct batadv_hard_iface *hard_iface; - struct batadv_softif_vlan *vlan; list_for_each_entry(hard_iface, &batadv_hardif_list, list) { if (hard_iface->soft_iface == soft_iface) batadv_hardif_disable_interface(hard_iface); } - /* destroy the "untagged" VLAN */ - vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS); - if (vlan) { - batadv_softif_destroy_vlan(bat_priv, vlan); - batadv_softif_vlan_put(vlan); - } - unregister_netdevice_queue(soft_iface, head); } diff --git a/net/batman-adv/soft-interface.h b/net/batman-adv/soft-interface.h index 9f2003f1a4972..13709a5d23e3b 100644 --- a/net/batman-adv/soft-interface.h +++ b/net/batman-adv/soft-interface.h @@ -22,6 +22,8 @@ void batadv_interface_rx(struct net_device *soft_iface, bool batadv_softif_is_valid(const struct net_device *net_dev); extern struct rtnl_link_ops batadv_link_ops; int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid); +void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv, + struct batadv_softif_vlan *vlan); void batadv_softif_vlan_release(struct kref *ref); struct batadv_softif_vlan *batadv_softif_vlan_get(struct batadv_priv *bat_priv, unsigned short vid); -- 2.47.3