Commit 6931d21f authored Mar 19, 2026 by Yang Yang Committed by Jakub Kicinski Mar 20, 2026

openvswitch: defer tunnel netdev_put to RCU release



ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already
detached the device. Dropping the netdev reference in destroy can race
with concurrent readers that still observe vport->dev.

Do not release vport->dev in ovs_netdev_tunnel_destroy(). Instead, let
vport_netdev_free() drop the reference from the RCU callback, matching
the non-tunnel destroy path and avoiding additional synchronization
under RTNL.

Fixes: a9020fde ("openvswitch: Move tunnel destroy function to oppenvswitch module.")
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Tested-by: Ao Zhou <n05ec@lzu.edu.cn>
Co-developed-by: Yuan Tan <tanyuan98@outlook.com>
Signed-off-by: Yuan Tan <tanyuan98@outlook.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Yang Yang <n05ec@lzu.edu.cn>
Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
Link: https://patch.msgid.link/20260319074241.3405262-1-n05ec@lzu.edu.cn


Signed-off-by: Jakub Kicinski <kuba@kernel.org>

parent e069034b

net/openvswitch/vport-netdev.c

+0 −2

Original line number	Diff line number	Diff line
		@@ -196,8 +196,6 @@ void ovs_netdev_tunnel_destroy(struct vport *vport)
		*/
		if (vport->dev->reg_state == NETREG_REGISTERED)
		rtnl_delete_link(vport->dev, 0, NULL);
		netdev_put(vport->dev, &vport->dev_tracker);
		vport->dev = NULL;
		rtnl_unlock();

		call_rcu(&vport->rcu, vport_netdev_free);