linux-next.git/drivers/net/ipvlan/ipvlan_main.c, branch master

ipvlan: Support per-netns netdev unregistration.

2026-07-11T10:57:50+00:00

When a lower device is unregistered, its upper ipvlan devices must also be unregistered. However, these upper devices may reside in different netns than the lower device. Let's use unregister_netdevice_queue_net() to support per-netns device unregistration for ipvlan. The new dying flag in struct ipvl_dev is used to avoid a race that ipvlan_link_delete() is called while its lower device is being removed in ipvlan_device_event(). If dying is true in ipvlan_link_delete(), the ipvlan device is already destructed but not yet unregistered. In this case, unregistration will be done in __rtnl_net_unlock() of the ->dellink() caller. Tested: 1. Create veth in ns1 and two ipvlan devices in ns2 and ns3. # ip netns add ns1 # ip netns add ns2 # ip netns add ns3 # ip -n ns1 link add veth0 type veth peer veth1 # ip -n ns2 link add ipvl2 link veth0 link-netns ns1 type ipvlan mode l2 # ip -n ns3 link add ipvl3 link veth0 link-netns ns1 type ipvlan mode l2 2. Run bpftrace to check that veth is unregistered first but wait ipvlan to be unregistered # bpftrace -e '#include kprobe:ipvlan_uninit, kprobe:veth_dellink, kprobe:free_netdev { $dev = (struct net_device *)arg0; printf("PID: %d | DEV: %s%s\n", pid, $dev->name, kstack()); }' 3. Remove the lower veth0 in ns1. # ip -n ns1 link del veth0 We can see that veth0 is freed after unregistering ipvl2 and ipvl3 in per-netns work because ipvl_port holds refcount of veth0. PID: 2010 | DEV: veth0 veth_dellink+5 rtnl_dellink+1213 rtnetlink_rcv_msg+1791 ... PID: 440 | DEV: ipvl2 ipvlan_uninit+5 unregister_netdevice_many_notify+7129 unregister_netdevice_many_net+1050 rtnl_net_work_func+136 process_scheduled_works+2538 ... PID: 440 | DEV: ipvl2 free_netdev+5 netdev_run_todo+4798 process_scheduled_works+2538 ... PID: 440 | DEV: ipvl3 ipvlan_uninit+5 unregister_netdevice_many_notify+7129 unregister_netdevice_many_net+1050 rtnl_net_work_func+136 process_scheduled_works+2538 ... PID: 2010 | DEV: veth0 free_netdev+5 netdev_run_todo+4798 rtnl_dellink+1507 rtnetlink_rcv_msg+1791 ... PID: 440 | DEV: ipvl3 free_netdev+5 netdev_run_todo+4798 process_scheduled_works+2538 ... Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260703001009.1572444-15-kuniyu@google.com Signed-off-by: Paolo Abeni

ipvlan: Protect ipvl_port.ipvlans with mutex.

2026-07-11T10:57:50+00:00

struct ipvl_port is shared between a lower device and its upper ipvlan devices. All upper devices are linked to ipvl_port.ipvlans. Once RTNL is removed, the list can be modified concurrently from different netns due to device removal. Let's protect it with a per-port mutex. NETDEV_PRECHANGEUPPER and NETDEV_CHANGEUPPER are explicitly skipped to avoid deadlock for netdev_upper_dev_unlink() called from NETDEV_UNREGISTER. Note that __ipvtap_dellink_ptr is added for CONFIG_IPVLAN=y but CONFIG_TAP=m and CONFIG_IPVTAP=m. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260703001009.1572444-14-kuniyu@google.com Signed-off-by: Paolo Abeni

ipvlan: Synchronise ipvlan_init() and ipvlan_uninit() for the same lower dev.

2026-07-11T10:57:50+00:00

ipvlan_uninit() for the last ipvlan device resets the lower device's rx_handler_data to NULL. Once RTNL is removed, ipvlan_init() would race with ipvlan_uninit(), which could leak a newly allocated ipvl_port. ipvlan_init() ipvlan_uninit() | |- if (refcount_dec_and_test(old_port)) ... |- ipvlan_port_destroy(old_port) | ' |- refcount_inc_not_zero(old_port) <-- fails |- ipvlan_port_create(phy_dev) . |- new_port = kzalloc() | |- phy_dev->rx_handler_data = new_port |- phy_dev->rx_handler_data = NULL ... `- kfree(old_port); Let's synchronise the two by holding the lower device's netdev_lock(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260703001009.1572444-13-kuniyu@google.com Signed-off-by: Paolo Abeni

ipvlan: Convert ipvl_port.count to refcount_t.

2026-07-11T10:57:50+00:00

struct ipvl_port is shared between a lower device and its upper ipvlan devices. While each upper device can always access ipvl_port safely via ipvlan_dev.port, the lower device relies on RTNL to access it via net_device.rx_handler_data. Once RTNL is removed, the lower device cannot read ipvl_port safely in ipvlan_device_event() because the port could be freed concurrently and net_device.rx_handler_data is set to NULL if the last ipvlan device in another namespace is unregistered. Let's convert ipvl_port.count to refcount_t and use RCU along with refcount_inc_not_zero() in ipvlan_device_event(). netdev_put() in ipvlan_port_destroy() is also moved down after cancel_work_sync(), which is the last user of port->dev. Note that ipvlan->port is now set in ipvlan_init() so that it can be used in ipvlan_uninit(), instead of ipvlan_port_get_rtnl() (rtnl_dereference()). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260703001009.1572444-12-kuniyu@google.com Signed-off-by: Paolo Abeni

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

ipvlan: Make the addrs_lock be per port

2026-01-19T18:03:30+00:00

Make the addrs_lock be per port, not per ipvlan dev. Initial code seems to be written in the assumption, that any address change must occur under RTNL. But it is not so for the case of IPv6. So 1) Introduce per-port addrs_lock. 2) It was needed to fix places where it was forgotten to take lock (ipvlan_open/ipvlan_close) This appears to be a very minor problem though. Since it's highly unlikely that ipvlan_add_addr() will be called on 2 CPU simultaneously. But nevertheless, this could cause: 1) False-negative of ipvlan_addr_busy(): one interface iterated through all port->ipvlans + ipvlan->addrs under some ipvlan spinlock, and another added IP under its own lock. Though this is only possible for IPv6, since looks like only ipvlan_addr6_event() can be called without rtnl_lock. 2) Race since ipvlan_ht_addr_add(port) is called under different ipvlan->addrs_lock locks This should not affect performance, since add/remove IP is a rare situation and spinlock is not taken on fast paths. Fixes: 8230819494b3 ("ipvlan: use per device spinlock to protect addrs list updates") Signed-off-by: Dmitry Skorodumov Reviewed-by: Paolo Abeni Link: https://patch.msgid.link/20260112142417.4039566-2-skorodumov.dmitry@huawei.com Signed-off-by: Jakub Kicinski

net: s/dev_pre_changeaddr_notify/netif_pre_changeaddr_notify/

2025-07-19T00:27:47+00:00

Commit cc34acd577f1 ("docs: net: document new locking reality") introduced netif_ vs dev_ function semantics: the former expects locked netdev, the latter takes care of the locking. We don't strictly follow this semantics on either side, but there are more dev_xxx handlers now that don't fit. Rename them to netif_xxx where appropriate. netif_pre_changeaddr_notify is used only by ipvlan/bond, so move it into NETDEV_INTERNAL namespace. Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250717172333.1288349-4-sdf@fomichev.me Signed-off-by: Jakub Kicinski

net: move misc netdev_lock flavors to a separate header

2025-03-08T17:06:50+00:00

Move the more esoteric helpers for netdev instance lock to a dedicated header. This avoids growing netdevice.h to infinity and makes rebuilding the kernel much faster (after touching the header with the helpers). The main netdev_lock() / netdev_unlock() functions are used in static inlines in netdevice.h and will probably be used most commonly, so keep them in netdevice.h. Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250307183006.2312761-1-kuba@kernel.org Signed-off-by: Jakub Kicinski

net: Use link/peer netns in newlink() of rtnl_link_ops

2025-02-21T23:28:02+00:00

Add two helper functions - rtnl_newlink_link_net() and rtnl_newlink_peer_net() for netns fallback logic. Peer netns falls back to link netns, and link netns falls back to source netns. Convert the use of params->net in netdevice drivers to one of the helper functions for clarity. Signed-off-by: Xiao Liang Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250219125039.18024-4-shaw.leon@gmail.com Signed-off-by: Jakub Kicinski