From c71d33e31b0e261d1bfb3ab1a2f909ed560156e6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Jean?= Date: Wed, 7 Oct 2026 20:12:37 +0000 Subject: [PATCH] mpls: unregister sysctls before network device teardown MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On network namespace exit, loopback is freed before MPLS unregisters its sysctls. A task can keep platform_labels open and write to it during exit. The handler can then use the freed loopback device. Unregister the sysctls in pre_exit. Cc: stable+noautosel@kernel.org # LLM report + LLM fix, not seen in real life Fixes: 7720c01f3f59 ("mpls: Add a sysctl to control the size of the mpls label table") Signed-off-by: Jérémy Jean Link: https://patch.msgid.link/20261007201237.171863-2-Jeremy.Jean@oss.cyber.gouv.fr Signed-off-by: Jakub Kicinski --- net/mpls/af_mpls.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c index 17b78dcbf8ab..ad4ad6f2001a 100644 --- a/net/mpls/af_mpls.c +++ b/net/mpls/af_mpls.c @@ -2776,16 +2776,20 @@ static __net_init int mpls_net_init(struct net *net) return 0; } -static __net_exit void mpls_net_exit(struct net *net) +static __net_exit void mpls_net_pre_exit(struct net *net) { - struct mpls_route __rcu **platform_label; - size_t platform_labels; const struct ctl_table *table; - unsigned int index; table = net->mpls.ctl->ctl_table_arg; unregister_net_sysctl_table(net->mpls.ctl); kfree(table); +} + +static __net_exit void mpls_net_exit(struct net *net) +{ + struct mpls_route __rcu **platform_label; + size_t platform_labels; + unsigned int index; /* An rcu grace period has passed since there was a device in * the network namespace (and thus the last in flight packet) @@ -2816,6 +2820,7 @@ static __net_exit void mpls_net_exit(struct net *net) static struct pernet_operations mpls_net_ops = { .init = mpls_net_init, + .pre_exit = mpls_net_pre_exit, .exit = mpls_net_exit, };