[PATCH net 1/1] net: devlink: fix reload error on netns teardown

From: Zixuan Chai <redacted>

When namespace teardown reloads a devlink instance into init_net, a
reload_down() error currently skips the namespace transition bookkeeping.
The devlink then remains registered with a pointer to the namespace being
destroyed, which can be freed before later notifications use it.

If reload_down() fails while the current namespace is dying, move the
devlink to the requested destination namespace before returning the
original error. Keep existing behavior for reload failures in live
namespaces and for reloads that do not change namespaces.

Fixes: 070c63f20f6c ("net: devlink: allow to change namespaces during reload")
Cc: stable@vger.kernel.org
Reported-by: Vega <redacted>
Close: https://bugtracker.nebusec.ai/f/11365
Assisted-by: LLM
Signed-off-by: Zixuan Chai <redacted>
Signed-off-by: Ren Wei <redacted>
---
 net/devlink/dev.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/devlink/dev.c b/net/devlink/dev.c
index 55959b0ff5ab..5d201f3d49e4 100644
--- a/net/devlink/dev.c
+++ b/net/devlink/dev.c

@@ -460,8 +460,13 @@ int devlink_reload(struct devlink *devlink, struct net *dest_net,
 	       sizeof(remote_reload_stats));
 
 	err = devlink->ops->reload_down(devlink, !!dest_net, action, limit, extack);
-	if (err)
+	if (err) {
+		curr_net = devlink_net(devlink);
+		if (dest_net && curr_net->is_dying &&
+		    !net_eq(dest_net, curr_net))
+			devlink_reload_netns_change(devlink, curr_net, dest_net);
 		return err;
+	}
 
 	curr_net = devlink_net(devlink);
 	if (dest_net && !net_eq(dest_net, curr_net))

-- 
2.34.1