From 3cbbc9fa33382d03f2813118e672eb318eba9cde Mon Sep 17 00:00:00 2001 From: Yuyang Huang Date: Sat, 11 Jul 2026 09:54:02 +0900 Subject: [PATCH 1/3] net: prestera: ignore duplicate RIF destruction events During address teardown, the inetaddr notifier may be called multiple times for the same interface. Ignore NETDEV_DOWN events if the RIF has already been destroyed, rather than returning -EEXIST, which aborts the notifier chain. Cc: Ido Schimmel Cc: Kuniyuki Iwashima Signed-off-by: Yuyang Huang Link: https://patch.msgid.link/20260711005405.2861680-2-yuyanghuang@google.com Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/marvell/prestera/prestera_router.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/marvell/prestera/prestera_router.c b/drivers/net/ethernet/marvell/prestera/prestera_router.c index b036b173a308..0c4f462baa6e 100644 --- a/drivers/net/ethernet/marvell/prestera/prestera_router.c +++ b/drivers/net/ethernet/marvell/prestera/prestera_router.c @@ -1302,10 +1302,8 @@ static int __prestera_inetaddr_port_event(struct net_device *port_dev, dev_hold(port_dev); break; case NETDEV_DOWN: - if (!re) { - NL_SET_ERR_MSG_MOD(extack, "Can't find RIF"); - return -EEXIST; - } + if (!re) + return 0; prestera_rif_entry_destroy(port->sw, re); dev_put(port_dev); break; From e5b14e9ae82b6ba661a40bcf13c5cfe0d3254628 Mon Sep 17 00:00:00 2001 From: Yuyang Huang Date: Sat, 11 Jul 2026 09:54:03 +0900 Subject: [PATCH 2/3] wifi: mac80211: use ifa_dev from event argument During address teardown, the netdevice's ip_ptr might be cleared before the inetaddr notifier is called. In this case, __in_dev_get_rtnl() returns NULL, causing the notifier to abort early and fail to update the ARP filter. Fix this by using the in_device pointer from the event argument (ifa->ifa_dev) which is guaranteed to be valid. Cc: Ido Schimmel Cc: Kuniyuki Iwashima Signed-off-by: Yuyang Huang Link: https://patch.msgid.link/20260711005405.2861680-3-yuyanghuang@google.com Signed-off-by: Jakub Kicinski --- net/mac80211/main.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/net/mac80211/main.c b/net/mac80211/main.c index eb1eaaf34612..f996e15e3d9e 100644 --- a/net/mac80211/main.c +++ b/net/mac80211/main.c @@ -588,9 +588,7 @@ static int ieee80211_ifa_changed(struct notifier_block *nb, if (sdata->vif.type != NL80211_IFTYPE_STATION) return NOTIFY_DONE; - idev = __in_dev_get_rtnl(sdata->dev); - if (!idev) - return NOTIFY_DONE; + idev = ifa->ifa_dev; ifmgd = &sdata->u.mgd; From aa22336b76b732d2c890f9de3419e05873711027 Mon Sep 17 00:00:00 2001 From: Yuyang Huang Date: Sat, 11 Jul 2026 09:54:04 +0900 Subject: [PATCH 3/3] net: ipv4: clear dev->ip_ptr before destroying inetdev To prevent RCU readers from accessing a partially destroyed in_device, clear dev->ip_ptr early in inetdev_destroy() before freeing the multicast list and individual IP addresses. This aligns the IPv4 teardown sequence with the IPv6 implementation. Cc: Kuniyuki Iwashima Signed-off-by: Yuyang Huang Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20260711005405.2861680-4-yuyanghuang@google.com Signed-off-by: Jakub Kicinski --- net/ipv4/devinet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c index a35b72662e43..3b31f4bec30e 100644 --- a/net/ipv4/devinet.c +++ b/net/ipv4/devinet.c @@ -322,6 +322,8 @@ static void inetdev_destroy(struct in_device *in_dev) in_dev->dead = 1; + RCU_INIT_POINTER(dev->ip_ptr, NULL); + ip_mc_destroy_dev(in_dev); while ((ifa = rtnl_dereference(in_dev->ifa_list)) != NULL) { @@ -329,8 +331,6 @@ static void inetdev_destroy(struct in_device *in_dev) inet_free_ifa(ifa); } - RCU_INIT_POINTER(dev->ip_ptr, NULL); - devinet_sysctl_unregister(in_dev); neigh_parms_release(&arp_tbl, in_dev->arp_parms); arp_ifdown(dev);