Re: [PATCH net] openvswitch: vport: fix race between tunnel creation and linking

[Eelco Chaudron]

On 30 Apr 2026, at 23:32, Ilya Maximets wrote:

> When a tunnel vport is created it first creates the tunnel device, e.g.,
> with geneve_dev_create_fb(), then it calls ovs_netdev_link() to take a
> reference and link it to the device that represents openvswitch datapath.
>
> The creation of the device is happening under RTNL, but then RTNL is
> released and re-acquired to find the device by name.  It is technically
> possible for the tunnel device to be re-named or deleted within that
> window while RTNL is not held, and some other device created in its
> place.  This will cause a non-tunnel device to be referenced in the
> vport and tunnel-specific functions used on it, e.g. vxlan_get_options()
> that directly casts the private netdev data into a struct vxlan_dev
> causing an invalid memory access:
>
>  BUG: KASAN: slab-use-after-free in vxlan_get_options+0x323/0x3a0
>   vxlan_get_options+0x323/0x3a0
>   ovs_vport_cmd_new+0x6e3/0xd30
>
> Fix that by taking a reference to the just created device before
> releasing RTNL.  This ensures that the device in the vport is always
> the one that was just created.  The search by name is only needed
> for a standard vport-netdev that links pre-existing devices, so that
> functionality and device type checks are moved to netdev_create().
>
> It is also awkward that ovs_netdev_link() takes ownership of the vport
> and destroys it on failure.  It doesn't know the type of the port it is
> dealing with, so we need to pass down the indicator that it's a tunnel,
> so the link can be properly deleted on failure.
>
> It's possible to refactor the logic to make the ovs_netdev_link() do
> only the linking part and let the callers perform a proper destruction,
> but it will be much more code for each legacy tunnel port type, so it
> is not worth it for the bug fix.
>
> Fixes: 614732eaa12d ("openvswitch: Use regular VXLAN net_device device")
> Reported-by: Yuan Tan <tanyuan98@xxxxxxxxxxx>
> Reported-by: Yifan Wu <yifanwucs@xxxxxxxxx>
> Reported-by: Juefei Pu <tomapufckgml@xxxxxxxxx>
> Reported-by: Xin Liu <bird@xxxxxxxxxx>
> Reported-by: Yang Yang <n05ec@xxxxxxxxxx>
> Signed-off-by: Ilya Maximets <i.maximets@xxxxxxx>

Thanks for working on this Ilya! The changes look good to me.

Acked-by: Eelco Chaudron <echaudro@xxxxxxxxxx>