kernel/git/stable/linux.git/drivers/net/bareudp.c, branch master

bareudp: Support per-netns netdev unregistration.

2026-07-11T10:57:50+00:00

bareudp_exit_rtnl_net() iterates bareudp devices whose sockets are in the dying netns and queues them for destruction. So the devices may reside in different netns. Let's use unregister_netdevice_queue_net() to support per-netns device unregistration. list_del() is changed to list_del_init() to avoid queueing the same device twice. Even after bareudp_exit_rtnl_net() queues a cross-netns bareudp device, bareudp_dellink() could be called concurrently for it (once RTNL is removed). In such a case, __rtnl_net_unlock() will perform the unregistration. Note that bareudp uses register_pernet_subsys() instead of _device(), so default_device_exit_batch() guarantees that the async per-netns works are flushed before ->exit(). Tested: 1. Create bareudp device across two netns. # ip netns add ns1 # ip netns add ns2 # ip -n ns1 link add bareudp0 link-netns ns2 type bareudp \ dstport 9292 ethertype ipv4 2. Run bpftrace to check that bareudp_uninit() is called between ->exit_rtnl() and ->exit(). # bpftrace -e '#include kprobe:bareudp_uninit { $dev = (struct net_device *)arg0; printf("PID: %d | DEV: %s%s\n", pid, $dev->name, kstack()); } kprobe:bareudp_exit_rtnl_net, kprobe:bareudp_exit_net { printf("PID: %d%s\n", pid, kstack()); }' 3. Remove the netns where the bareudp socket resides # ip netns del ns2 Now, we can see bareudp0 is unregistered by per-netns work instead of cleanup_net() and it finishes before ->exit() to avoid WARN_ON_ONCE(!list_empty(&bn->bareudp_list)) there. PID: 576 bareudp_exit_rtnl_net+5 ops_undo_list+702 cleanup_net+1122 process_scheduled_works+2538 ... PID: 470 | DEV: bareudp0 bareudp_uninit+5 unregister_netdevice_many_notify+7129 unregister_netdevice_many_net+1050 rtnl_net_work_func+136 process_scheduled_works+2538 ... PID: 576 bareudp_exit_net+5 ops_undo_list+1064 cleanup_net+1122 process_scheduled_works+2538 Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260703001009.1572444-11-kuniyu@google.com Signed-off-by: Paolo Abeni

bareudp: Protect bareudp_list with mutex.

2026-07-11T10:57:50+00:00

struct bareudp_dev.net is the netns where the backend bareudp socket resides. struct bareudp_dev is linked to the bareudp_net.bareudp_list of the socket's netns. During netns dismantle or module unload, bareudp_exit_rtnl_net() iterates the list and queues devices for destruction regardless of the devices' netns. Thus, once RTNL is removed, the list can be modified concurrently from different netns due to device removal. Let's protect it with per-netns mutex. bareudp_newlink() is still protected by rtnl_net_lock()s, so acquiring bn->lock twice in bareudp_find_dev() and bareudp_configure() is not a problem. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260703001009.1572444-10-kuniyu@google.com Signed-off-by: Paolo Abeni

bareudp: Use rtnl_dereference() in bareudp_sock_release().

2026-05-21T02:12:29+00:00

kernel test robot reported sparse warning in bareudp_sock_release(): drivers/net/bareudp.c:288:12: warning: incorrect type in assignment (different address spaces) drivers/net/bareudp.c:288:12: expected struct sock *sk drivers/net/bareudp.c:288:12: got struct sock [noderef] __rcu *sk The warning is not new and exists since the initial bareudp commit 571912c69f0e ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc."). Let's use rtnl_dereference(). Note that bareudp_sock_release() is called from bareudp_stop() under RTNL, so there is no real issue even without the helper. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202605062359.e3gOfZCr-lkp@intel.com/ Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260518050726.318824-6-kuniyu@google.com Signed-off-by: Jakub Kicinski

bareudp: Remove synchronize_net() in bareudp_sock_release().

2026-05-21T02:12:29+00:00

synchronize_net() in bareudp_sock_release() has existed since day 1, commit 571912c69f0e ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc."). It was most likely copied from a similar tunneling device like vxlan or geneve. bareudp_sock_release() is called from dev->netdev_ops->ndo_stop(), and synchronize_net() in unregister_netdevice_many_notify() ensures that inflight bareudp fast paths finish before bareudp_dev is freed. Let's remove the redundant synchronize_net() in bareudp_sock_release(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260518050726.318824-5-kuniyu@google.com Signed-off-by: Jakub Kicinski

bareudp: Store struct sock in struct bareudp_dev.

2026-05-06T00:47:05+00:00

bareudp does not need to access struct socket itself in the fast path; it only reads struct sock, and struct socket is only used for tunnel setup and teardown. Let's store struct sock directly in struct bareudp_dev. bareudp_sock_release() is called from dev->netdev_ops->ndo_stop(). synchronize_net() in unregister_netdevice_many_notify() ensures that inflight bareudp RX fast paths finish before bareudp_dev is freed. bareudp no longer needs synchronize_rcu() in udp_tunnel_sock_release(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260502031401.3557229-11-kuniyu@google.com Signed-off-by: Jakub Kicinski

udp_tunnel: Pass struct sock to udp_tunnel6_dst_lookup().

2026-05-06T00:47:04+00:00

None of the udp_tunnel users need struct socket in their fast paths; it is only used for tunnel setup / teardown. Even udp_tunnel6_dst_lookup() does not need struct socket. Let's change udp_tunnel6_dst_lookup() to take struct sock instead of struct socket. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260502031401.3557229-4-kuniyu@google.com Signed-off-by: Jakub Kicinski

udp_tunnel: Pass struct sock to setup_udp_tunnel_sock().

2026-05-06T00:47:04+00:00

None of the udp_tunnel users need struct socket in their fast paths; it is only used for tunnel setup / teardown. Even setup_udp_tunnel_sock() does not need struct socket. Let's change setup_udp_tunnel_sock() to take struct sock instead of struct socket. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260502031401.3557229-3-kuniyu@google.com Signed-off-by: Jakub Kicinski

udp_tunnel: Pass struct sock to udp_tunnel_sock_release().

2026-05-06T00:47:03+00:00

None of the udp_tunnel users need struct socket in their fast paths; it is only used for tunnel setup / teardown. While the UDP tunnel interface accepts struct socket, this encourages users to store the pointer unnecessarily. This leads to extra dereferences when accessing struct sock fields (e.g., sk->sk_user_data instead of sock->sk->sk_user_data). Furthermore, these dereferences necessitate synchronize_rcu() in udp_tunnel_sock_release() to protect the fast paths from sock_orphan() setting sk->sk_socket to NULL. This overhead can be avoided if users store the struct sock pointer directly in their private structures. As a prep, let's change udp_tunnel_sock_release() to take struct sock instead of struct socket. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260502031401.3557229-2-kuniyu@google.com Signed-off-by: Jakub Kicinski

bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()

2026-04-29T01:16:53+00:00

bareudp_fill_metadata_dst() passes bareudp->sock to udp_tunnel6_dst_lookup() in the IPv6 path without a NULL check. The socket is only created in bareudp_open() and NULLed in bareudp_stop(), so calling this function while the device is down triggers a NULL dereference via sock->sk. BUG: kernel NULL pointer dereference, address: 0000000000000018 RIP: 0010:udp_tunnel6_dst_lookup (net/ipv6/ip6_udp_tunnel.c:160) Call Trace: bareudp_fill_metadata_dst (drivers/net/bareudp.c:532) do_execute_actions (net/openvswitch/actions.c:901) ovs_execute_actions (net/openvswitch/actions.c:1589) ovs_packet_cmd_execute (net/openvswitch/datapath.c:700) genl_family_rcv_msg_doit (net/netlink/genetlink.c:1114) genl_rcv_msg (net/netlink/genetlink.c:1209) netlink_rcv_skb (net/netlink/af_netlink.c:2550) Add a NULL check returning -ESHUTDOWN, consistent with the xmit paths in the same driver. Fixes: 571912c69f0e ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc.") Reported-by: Xiang Mei Signed-off-by: Weiming Shi Reviewed-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20260426165350.1663137-2-bestswngs@gmail.com Signed-off-by: Jakub Kicinski

net: ipv6: Add a flags argument to ip6tunnel_xmit(), udp_tunnel6_xmit_skb()

2025-06-18T01:18:45+00:00

ip6tunnel_xmit() erases the contents of the SKB control block. In order to be able to set particular IP6CB flags on the SKB, add a corresponding parameter, and propagate it to udp_tunnel6_xmit_skb() as well. In one of the following patches, VXLAN driver will use this facility to mark packets as subject to IPv6 multicast routing. Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/acb4f9f3e40c3a931236c3af08a720b017fbfbfb.1750113335.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski