From: Haiyang Zhang haiyangz@microsoft.com
The loop in default_device_exit_net() won't be able to properly detect the head then stop, and will hit NULL pointer, when a driver, like hv_netvsc, automatically moves the slave device together with the master device.
To fix this, add a helper function to return the first migratable netdev correctly, no matter one or two devices were removed from this net's list in the last iteration.
Cc: stable@vger.kernel.org # 5.4+ Signed-off-by: Haiyang Zhang haiyangz@microsoft.com --- net/core/dev.c | 31 +++++++++++++++++++++---------- 1 file changed, 21 insertions(+), 10 deletions(-)
diff --git a/net/core/dev.c b/net/core/dev.c index 621a639aeba1..d83f5f12cf70 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -12629,19 +12629,11 @@ static struct pernet_operations __net_initdata netdev_net_ops = { .exit = netdev_exit, };
-static void __net_exit default_device_exit_net(struct net *net) +static inline struct net_device *first_migratable_netdev(struct net *net) { - struct netdev_name_node *name_node, *tmp; struct net_device *dev, *aux; - /* - * Push all migratable network devices back to the - * initial network namespace - */ - ASSERT_RTNL(); - for_each_netdev_safe(net, dev, aux) { - int err; - char fb_name[IFNAMSIZ];
+ for_each_netdev_safe(net, dev, aux) { /* Ignore unmoveable devices (i.e. loopback) */ if (dev->netns_immutable) continue; @@ -12650,6 +12642,25 @@ static void __net_exit default_device_exit_net(struct net *net) if (dev->rtnl_link_ops && !dev->rtnl_link_ops->netns_refund) continue;
+ return dev; + } + + return NULL; +} + +static void __net_exit default_device_exit_net(struct net *net) +{ + struct netdev_name_node *name_node, *tmp; + struct net_device *dev; + /* + * Push all migratable network devices back to the + * initial network namespace + */ + ASSERT_RTNL(); + while ((dev = first_migratable_netdev(net)) != NULL) { + int err; + char fb_name[IFNAMSIZ]; + /* Push remaining network devices to init_net */ snprintf(fb_name, IFNAMSIZ, "dev%d", dev->ifindex); if (netdev_name_in_use(&init_net, fb_name))
On Fri, Jul 18, 2025 at 1:21 PM Haiyang Zhang haiyangz@linux.microsoft.com wrote:
From: Haiyang Zhang haiyangz@microsoft.com
The loop in default_device_exit_net() won't be able to properly detect the head then stop, and will hit NULL pointer, when a driver, like hv_netvsc, automatically moves the slave device together with the master device.
To fix this, add a helper function to return the first migratable netdev correctly, no matter one or two devices were removed from this net's list in the last iteration.
Cc: stable@vger.kernel.org # 5.4+
We (network maintainers) prefer a Fixes: tag, so that we can look at the blamed patch, rather than trusting your '5.4' hint.
Without a Fixes tag, you are forcing each reviewer to do the archeology work, and possibly completely miss your point.
-----Original Message----- From: Eric Dumazet edumazet@google.com Sent: Tuesday, July 22, 2025 2:52 AM To: Haiyang Zhang haiyangz@linux.microsoft.com Cc: linux-hyperv@vger.kernel.org; netdev@vger.kernel.org; Haiyang Zhang haiyangz@microsoft.com; KY Srinivasan kys@microsoft.com; wei.liu@kernel.org; kuba@kernel.org; pabeni@redhat.com; horms@kernel.org; davem@davemloft.net; sdf@fomichev.me; kuniyu@google.com; ahmed.zaki@intel.com; aleksander.lobakin@intel.com; linux- kernel@vger.kernel.org; stable@vger.kernel.org; #@linux.microsoft.com; 5.4+@linux.microsoft.com Subject: [EXTERNAL] Re: [PATCH net] net: core: Fix the loop in default_device_exit_net()
On Fri, Jul 18, 2025 at 1:21 PM Haiyang Zhang haiyangz@linux.microsoft.com wrote:
From: Haiyang Zhang haiyangz@microsoft.com
The loop in default_device_exit_net() won't be able to properly detect
the
head then stop, and will hit NULL pointer, when a driver, like
hv_netvsc,
automatically moves the slave device together with the master device.
To fix this, add a helper function to return the first migratable netdev correctly, no matter one or two devices were removed from this net's
list
in the last iteration.
Cc: stable@vger.kernel.org # 5.4+
We (network maintainers) prefer a Fixes: tag, so that we can look at the blamed patch, rather than trusting your '5.4' hint.
Without a Fixes tag, you are forcing each reviewer to do the archeology work, and possibly completely miss your point.
Thanks. I will have the Fixes tag in the new patch.
- Haiyang
linux-stable-mirror@lists.linaro.org