From 0239bd767b3ae5d361f348a88babd33a15d498a6 Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Sat, 12 Sep 2026 23:00:28 +0000 Subject: [PATCH] ip_tunnel: Set itn->fb_tunnel_dev to NULL in ip_tunnel_delete_net(). ip_tunnel_dellink() ignores itn->fb_tunnel_dev, so the per-netns fallback tunnel device cannot be removed by userspace. This also makes default_device_exit_batch() impossible to remove the device since it calls ->dellink(). So, ip_tunnel_delete_net() has to iterate devices in the dying netns and call unregister_netdevice_queue() directly. But then, this duplicates ip_tunnel_del() in ip_tunnel_dellink() and ip_tunnel_uninit(). Let's set itn->fb_tunnel_dev to NULL in ip_tunnel_delete_net() and remove for_each_netdev_safe() in ip_tunnel_delete_net(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260912230043.2586313-3-kuniyu@google.com Reviewed-by: Ido Schimmel Signed-off-by: Paolo Abeni --- net/ipv4/ip_tunnel.c | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c index 13b5e35e8790..d74200ab5762 100644 --- a/net/ipv4/ip_tunnel.c +++ b/net/ipv4/ip_tunnel.c @@ -1153,26 +1153,19 @@ void ip_tunnel_delete_net(struct net *net, unsigned int id, struct list_head *head) { struct ip_tunnel_net *itn = net_generic(net, id); - struct net_device *dev, *aux; int h; ASSERT_RTNL_NET(net); - for_each_netdev_safe(net, dev, aux) - if (dev->rtnl_link_ops == ops) - unregister_netdevice_queue(dev, head); + WRITE_ONCE(itn->fb_tunnel_dev, NULL); for (h = 0; h < IP_TNL_HASH_SIZE; h++) { - struct ip_tunnel *t; - struct hlist_node *n; struct hlist_head *thead = &itn->tunnels[h]; + struct hlist_node *n; + struct ip_tunnel *t; hlist_for_each_entry_safe(t, n, thead, hash_node) - /* If dev is in the same netns, it has already - * been added to the list by the previous loop. - */ - if (!net_eq(dev_net(t->dev), net)) - unregister_netdevice_queue(t->dev, head); + unregister_netdevice_queue(t->dev, head); } } EXPORT_SYMBOL_GPL(ip_tunnel_delete_net); @@ -1308,8 +1301,6 @@ void ip_tunnel_uninit(struct net_device *dev) itn = net_generic(net, tunnel->ip_tnl_net_id); ip_tunnel_del(itn, netdev_priv(dev)); - if (itn->fb_tunnel_dev == dev) - WRITE_ONCE(itn->fb_tunnel_dev, NULL); dst_cache_reset(&tunnel->dst_cache); }