Re: [PATCH net] amt: tear down every amt device on an unregistering lower

[Simon Horman <horms@kernel.org>]

On Thu, Nov 05, 2026 at 11:23:02PM +0000, Omar Ramadan wrote:
> amt_device_event() acts only on the amt device that
> amt_lookup_upper_dev() returns, which is the first amt device bound to
> the event's lower. Several amt devices can share one lower, for
> example two gateways.
> 
> On NETDEV_UNREGISTER, only the first device is unlinked and
> unregistered. The others stay upper-linked to the lower, and
> unregister_netdevice_many_notify() warns, because the notifier chain
> must detach every upper device. They also still hold a reference on
> the lower, so each is torn down only when netdev_wait_allrefs_any(),
> called from netdev_run_todo(), rebroadcasts NETDEV_UNREGISTER. By then
> the lower's sysfs directory is gone, so unlinking it trips a kernfs
> WARN, and unregistering it from inside the rebroadcast trips the WARN
> in __rtnl_unlock(). On NETDEV_CHANGEMTU, only the first device is
> resized.
> 
> Walk every amt device in the lower's netns and act on each one bound
> to the lower. On NETDEV_UNREGISTER, queue them all and unregister them
> in one batch. amt_dellink() unlinks each device but leaves it on the
> netns device list until unregister_netdevice_many(), so the walk stays
> valid under RTNL.
> 
> To reproduce:
> 
>   ip link add lower0 type dummy
>   ip link add amtg1 type amt mode gateway local 192.0.2.1 \
>           discovery 192.0.2.2 dev lower0
>   ip link add amtg2 type amt mode gateway local 192.0.2.1 \
>           discovery 192.0.2.2 dev lower0
>   ip link del lower0
> 
> Without this patch, the last command logs:
> 
>   WARNING: net/core/dev.c:12773 at unregister_netdevice_many_notify+0x13e5/0x1940, CPU#3: ip/216
>   kernfs: can not remove 'upper_amtg2', no directory
>   WARNING: fs/kernfs/dir.c:1784 at kernfs_remove_by_name_ns+0xc9/0xd0, CPU#0: ip/216
>   WARNING: net/core/rtnetlink.c:141 at __rtnl_unlock+0xb2/0xf0, CPU#0: ip/216
>   WARNING: net/core/rtnetlink.c:141 at __rtnl_unlock+0xb2/0xf0, CPU#0: ip/216
> 
> With it, the commands log nothing and remove both amt devices, and
> tools/testing/selftests/net/amt.sh passes on a KASAN and lockdep
> kernel.
> 
> Found by a selftest for our upcoming AMT offload RFC, which deletes a
> lower carrying two amt gateways, on our 6.18-based driver. The
> commands above reproduce it on net.
> 
> Fixes: b9022b53adad ("amt: add control plane of amt interface")
> Assisted-by: LLM
> Signed-off-by: Omar Ramadan <omar@blockcast.net>

Reviewed-by: Simon Horman <horms@kernel.org>