Re: [PATCH net] net: hsr: clean up the slave VLAN filters when deleting a port

On 7/14/26 7:07 PM, Felix Maurer wrote:

On Tue, Jul 14, 2026 at 04:06:36PM +0800, Jiayuan Chen wrote:

quoted

Our internal syzkaller reported this warning:

   netdevsim netdevsim10 eth0: entered promiscuous mode
   netdevsim netdevsim10 eth1: entered promiscuous mode
   netdevsim netdevsim10 eth1 (unregistering): left promiscuous mode
   ------------[ cut here ]------------
   WARNING: drivers/net/netdevsim/netdev.c:1208 at nsim_destroy+0x276/0x6e0, CPU#3: 1/46
   Modules linked in:
   CPU: 3 UID: 0 PID: 46 Comm: kworker/u16:1 Not tainted 7.2.0-rc2+ #286 PREEMPT
   Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
   Workqueue: netns cleanup_net
   RIP: 0010:nsim_destroy (drivers/net/netdevsim/netdev.c:1031 drivers/net/netdevsim/netdev.c:1201)
   RSP: 0018:ffffc90000337898 EFLAGS: 00010293
   RAX: 0000000000000001 RBX: ffff8881036c8b00 RCX: 0000000000000000
   RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
   RBP: ffffc900003378f0 R08: 0000000000000000 R09: 0000000000000000
   R10: ffffffffad4186a8 R11: ffffffffad41c3db R12: ffff8881036c9268
   R13: dffffc0000000000 R14: ffffed10206d9164 R15: 0000000000000001
   FS:  0000000000000000(0000) GS:ffff888160866000(0000) knlGS:0000000000000000
   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
   CR2: 000055bcf1a2e0c4 CR3: 0000000105376003 CR4: 0000000000770ef0
   PKRU: 55555554
   Call Trace:
   <TASK>
   __nsim_dev_port_del (drivers/net/netdevsim/dev.c:1547)
   nsim_dev_reload_destroy (drivers/net/netdevsim/dev.c:1561 drivers/net/netdevsim/dev.c:1785)
   nsim_dev_reload_down (drivers/net/netdevsim/dev.c:1038)
   devlink_reload (net/devlink/dev.c:462)
   devlink_pernet_pre_exit (net/devlink/core.c:578)
   ops_undo_list (net/core/net_namespace.c:161 net/core/net_namespace.c:235)
   cleanup_net (net/core/net_namespace.c:706)
   process_one_work (kernel/workqueue.c:3322)
   worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)
   kthread (kernel/kthread.c:436)
   ret_from_fork (arch/x86/kernel/process.c:158)
   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
   </TASK>
   ---[ end trace 0000000000000000 ]---
   netdevsim netdevsim10 eth0 (unregistering): left promiscuous mode

vlan_vids_add_by_dev() is what passes the VID filter info down to the real
device. A virtual device does no filtering itself, so it has to push the
VIDs down to its slaves. HSR already does this correctly on the add side:
hsr_ndo_vlan_rx_add_vid() calls vlan_vid_add() on each slave.

We just never clean the slaves up on delete. hsr_del_port() drops the port
and leaves the VIDs sitting on the slave, so the filter entries leak.
netdevsim keeps a bitmap of the VIDs it was told to filter and checks that
it is empty when the netdev goes away, which is what trips the warning
above.

So do the cleanup in hsr_del_port(). We follow hsr_ndo_vlan_rx_add_vid()
here: it only pushes the VIDs to HSR_PT_SLAVE_A and HSR_PT_SLAVE_B, so the
del side only touches those two as well.

Reproducer:
ip netns add ns0
ip netns exec ns0 sh -c 'echo "10 2" > /sys/bus/netdevsim/new_device'
ip netns exec ns0 ip link add hsr0 type hsr slave1 eth0 slave2 eth1
ip netns exec ns0 ip link add link hsr0 name hsr0.1 type vlan id 1
ip netns del ns0

Thank you for your patch! The explanation and the patch look very
similar to a fix that Eric posted a week ago [1]. Can you check if
Eric's patch also fixes you reproducer? And if it does, please add your
Tested-by and/or Reviewed-by to the thread?

Thanks,
    Felix


[1]: https://lore.kernel.org/netdev/20260707082327.3238690-1-edumazet@google.com/ (local)

Thanks, It seems my patch is duplicated.