ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already
detached the device. Dropping the netdev reference in destroy can race
with concurrent readers that still observe vport->dev.

Do not release vport->dev in ovs_netdev_tunnel_destroy(). Instead, let
vport_netdev_free() drop the reference from the RCU callback, matching
the non-tunnel destroy path and avoiding additional synchronization
under RTNL.

Fixes: a9020fde67a6 ("openvswitch: Move tunnel destroy function to oppenvswitch module.")
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Tested-by: Ao Zhou <n05ec@lzu.edu.cn>
Co-developed-by: Yuan Tan <tanyuan98@outlook.com>
Signed-off-by: Yuan Tan <tanyuan98@outlook.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Yang Yang <n05ec@lzu.edu.cn>
---

 net/openvswitch/vport-netdev.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/net/openvswitch/vport-netdev.c b/net/openvswitch/vport-netdev.c
index 6574f9bcdc026..44dbe8a9b0778 100644
--- a/net/openvswitch/vport-netdev.c
+++ b/net/openvswitch/vport-netdev.c
@@ -189,8 +189,6 @@ void ovs_netdev_tunnel_destroy(struct vport *vport)
 	 */
 	if (vport->dev->reg_state == NETREG_REGISTERED)
 		rtnl_delete_link(vport->dev, 0, NULL);
-	netdev_put(vport->dev, &vport->dev_tracker);
-	vport->dev = NULL;
 	rtnl_unlock();
 
 	call_rcu(&vport->rcu, vport_netdev_free);
-- 
2.43.0

On 3/19/26 8:42 AM, Yang Yang wrote:
> ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already
> detached the device. Dropping the netdev reference in destroy can race
> with concurrent readers that still observe vport->dev.
> 
> Do not release vport->dev in ovs_netdev_tunnel_destroy(). Instead, let
> vport_netdev_free() drop the reference from the RCU callback, matching
> the non-tunnel destroy path and avoiding additional synchronization
> under RTNL.
> 
> Fixes: a9020fde67a6 ("openvswitch: Move tunnel destroy function to oppenvswitch module.")
> Reported-by: Yifan Wu <yifanwucs@gmail.com>
> Reported-by: Juefei Pu <tomapufckgml@gmail.com>
> Tested-by: Ao Zhou <n05ec@lzu.edu.cn>
> Co-developed-by: Yuan Tan <tanyuan98@outlook.com>
> Signed-off-by: Yuan Tan <tanyuan98@outlook.com>
> Suggested-by: Xin Liu <bird@lzu.edu.cn>
> Signed-off-by: Yang Yang <n05ec@lzu.edu.cn>
> ---
> 
>  net/openvswitch/vport-netdev.c | 2 --
>  1 file changed, 2 deletions(-)
> 
> diff --git a/net/openvswitch/vport-netdev.c b/net/openvswitch/vport-netdev.c
> index 6574f9bcdc026..44dbe8a9b0778 100644
> --- a/net/openvswitch/vport-netdev.c
> +++ b/net/openvswitch/vport-netdev.c
> @@ -189,8 +189,6 @@ void ovs_netdev_tunnel_destroy(struct vport *vport)
>  	 */
>  	if (vport->dev->reg_state == NETREG_REGISTERED)
>  		rtnl_delete_link(vport->dev, 0, NULL);
> -	netdev_put(vport->dev, &vport->dev_tracker);
> -	vport->dev = NULL;
>  	rtnl_unlock();
>  
>  	call_rcu(&vport->rcu, vport_netdev_free);

This should solve the issue indeed.  I ran OVS testsuite with
this as well, and it works fine.  Thanks!

Reviewed-by: Ilya Maximets <i.maximets@ovn.org>