)]}'
{
  "commit": "fd0909e963ed8f36967bd072ed484be7babe46de",
  "tree": "dbc15442e65e2dfcbecf7e3bf2088aeb28c231b8",
  "parents": [
    "dda51b73721684637ab8e9bd97c78228b99c4bd2"
  ],
  "author": {
    "name": "Naman Gulati",
    "email": "namangulati@google.com",
    "time": "Mon Oct 26 22:13:06 2026 +0000"
  },
  "committer": {
    "name": "Jakub Kicinski",
    "email": "kuba@kernel.org",
    "time": "Thu Oct 29 08:43:12 2026 -0700"
  },
  "message": "netdev-genl: ignore NETDEV_UNREGISTER rebroadcasts\n\nnetdev_wait_allrefs_any() re-sends NETDEV_UNREGISTER every second while\nit waits for the last references on a device to be dropped. By then\nnetdev_run_todo() has already marked the device NETREG_UNREGISTERED and\nRTNL has been dropped at least once since the initial notification sent\nby unregister_netdevice_many_notify().\n\nnetdev_genl_netdevice_event() does not tell these rebroadcasts apart\nfrom the initial notification and sends a NETDEV_CMD_DEV_DEL_NTF\nmulticast for each of them. At best this spams NETDEV_NLGRP_MGMT\nlisteners with duplicate notifications; at worst the pernet state of\nthe netns the device belongs to is already gone and the handler\ndereferences a NULL pointer.\n\ndefault_device_exit_batch() only unregisters the devices still listed\nin the exiting netns; it does not wait for in-flight unregistrations of\ndevices that were already unlisted (the barrier doing that was removed\nby commit 8a4fc54b07d7 (\"net: get rid of rtnl_lock_unregistering()\")).\nSo when a device is unregistered by something other than the\ncleanup_net() of its own netns while references on it are still held,\ne.g. a veth whose peer in another netns gets deleted, and that netns\nexits while the device is stuck in netdev_wait_allrefs_any(), the\nremaining pernet exit handlers run and genl_pernet_exit() sets\nnet-\u003egenl_sock to NULL. The next rebroadcast then crashes in\ngenl_has_listeners():\n\n  BUG: KASAN: null-ptr-deref in netlink_has_listeners+0x3d/0x3f0 net/netlink/af_netlink.c:1388\n  Read of size 8 at addr 0000000000000578 by task syz.0.0/5325\n  Call Trace:\n   \u003cTASK\u003e\n   netlink_has_listeners+0x3d/0x3f0 net/netlink/af_netlink.c:1388\n   genl_has_listeners include/net/genetlink.h:644 [inline]\n   netdev_genl_dev_notify+0x161/0x450 net/core/netdev-genl.c:93\n   netdev_genl_netdevice_event+0x98/0x3c0 net/core/netdev-genl.c:1491\n   notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85\n   netdev_wait_allrefs_any net/core/dev.c:11690 [inline]\n   netdev_run_todo+0x731/0x1060 net/core/dev.c:11808\n   rtnl_unlock net/core/rtnetlink.c:157 [inline]\n   rtnl_dellink+0x68f/0x810 net/core/rtnetlink.c:3707\n\nsyzbot hit this by moving one end of a veth pair into a short-lived\nnetns while netdevsim\u0027s deferred FIB event processing still held a\nreference on it, and then deleting the other end (repro [1]). While the\nsource of this bug is netdevsim deferring FIB processing for and holding\nonto the device reference for O(seconds) which is being fixed\nseparately [2], any driver may introduce such a delay and trigger the\nnull-ptr-deref.\n\nSkip the rebroadcasts, which are the only NETDEV_UNREGISTER events\ndelivered with reg_state \u003d\u003d NETREG_UNREGISTERED. The notifications sent\nby unregister_netdevice_many_notify() and, for a device leaving a netns,\nby __dev_change_net_namespace() are issued under RTNL in the same\ncritical section that unlists the device, before its netns can be torn\ndown, and keep being handled. This mirrors what ip6_route_dev_notify()\nalready does to cope with the rebroadcasts.\n\nThis change should not break the UAPI spec as it defines dev-del-ntf as\na \"Notification about device disappearing.\" which is a single event. The\nrebroadcast in netdev_wait_allrefs_any() exists to re-kick in-kernel\nsubsystems holding references; netdev-genl happens to be on the notifier\nchain and forwards it.\n\n[1] https://gist.github.com/NamanGulati/2d1b49b8757f9a88b0bd6e55018c02ae\n[2] https://lore.kernel.org/r/20261023191517.607834-1-kuniyu@google.com\n\nFixes: d3d854fd6a1d (\"netdev-genl: create a simple family for netdev stuff\")\nReported-by: syzbot+1269fe6cc2016008124e@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/netdev/6adf9f64.6200f071.51519.0ed1.GAE@google.com/\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nSigned-off-by: Naman Gulati \u003cnamangulati@google.com\u003e\nLink: https://patch.msgid.link/20261026221306.3151025-1-namangulati@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "c3aa367214acd2350e1f4da37b9cb59636c6e069",
      "old_mode": 33188,
      "old_path": "net/core/netdev-genl.c",
      "new_id": "384fdc5ae5145fd412e59d31bcde189099c25ed5",
      "new_mode": 33188,
      "new_path": "net/core/netdev-genl.c"
    }
  ]
}