Re: [PATCH net v2] ip6_gre: Use cached t->net in ip6erspan_changelink().

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@xxxxxxxxxx>:

On Thu, 30 Apr 2026 18:33:18 +0800 you wrote:
> After commit 5e72ce3e3980 ("net: ipv6: Use link netns in newlink() of
> rtnl_link_ops"), ip6erspan_newlink() correctly resolves the per-netns
> ip6gre hash via link_net. ip6erspan_changelink() was not converted in
> that series and still uses dev_net(dev), which diverges from the
> device's creation netns after IFLA_NET_NS_FD migration.
> 
> This re-inserts the tunnel into the wrong per-netns hash. The
> original netns keeps a stale entry. When that netns is later
> destroyed, ip6gre_exit_rtnl_net() walks the stale entry, producing a
> slab-use-after-free reported by KASAN, followed by a kernel BUG at
> net/core/dev.c (LIST_POISON1) in unregister_netdevice_many_notify().
> 
> [...]

Here is the summary with links:
  - [net,v2] ip6_gre: Use cached t->net in ip6erspan_changelink().
    https://git.kernel.org/netdev/net/c/1d324c2f43f7

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html