tbv 0.2.15: fix per-rail netdev teardown crash on peer disconnect

The per-rail GID netdev parented to xd->dev, making it a sibling of the
tb_services in xd->dev child list. On disconnect, icm_tr_xdomain_disconnected ->
tb_xdomain_remove iterates that child list; our service .remove unregister_netdev
deletes the netdev mid-iteration -> kernfs_find_and_get_ns NULL deref -> a
chain-wide crash CASCADE (one node crashes, drops its link, neighbours see a
disconnect, they crash too). kdump appmana-002 2026-06-22.

Fix (the thunderbolt_net pattern): parent the netdev to the stable, driver-owned
NHI/ring device the ib_device already uses, never xd->dev (tbv_ibdev_netdev_parent,
red-first KUnit, 34/34). The peer identity udev/GID needed from the parent is now
COPIED onto the netdev at attach as tbv_peer_uuid/tbv_peer_name sysfs attrs (no
lifetime tie to xd); the udev helpers read those and resolve the live ifname by
IFINDEX. peer->xd is refcounted + NULL-checked everywhere else -- this netdev
parent was the only teardown hazard.

Author: doctorpangloss

drivers/thunderbolt_ibverbs/dkms.conf

@@ -1,5 +1,5 @@
 PACKAGE_NAME="thunderbolt-ibverbs"
-PACKAGE_VERSION="0.2.14"
+PACKAGE_VERSION="0.2.15"
 
 BUILT_MODULE_NAME[0]="thunderbolt_ibverbs"
 BUILT_MODULE_LOCATION[0]="kernel"

drivers/thunderbolt_ibverbs/kernel/ibdev.c

@@ -399,6 +399,14 @@ struct tbv_ibdev {
 	 * rails for the same peer by tbv_select_qp_rail_locked().
 	 */
 	struct tbv_rail *rail;
+	/*
+	 * Peer identity COPIED from the XDomain at attach (no lifetime tie to
+	 * xd) and exposed as netdev sysfs attrs (tbv_peer_uuid / tbv_peer_name).
+	 * The netdev now parents to the stable NHI, not xd, so udev naming and
+	 * the per-link GID helper read the peer from the netdev itself.
+	 */
+	char peer_uuid[UUID_STRING_LEN + 1];
+	char peer_name[64];
 };
 
 struct tbv_send_ctx {
@@ -2362,6 +2370,55 @@ static void tbv_netdev_setup(struct net_device *ndev)
  * to the rail's Thunderbolt device for matching) so both ends of a link share a
  * subnet. The netdev carries no traffic; the rail's data path is native TB.
  */
+/*
+ * Per-rail netdev sysfs: the COPIED peer identity, read back from the netdev's
+ * drvdata (the tbv_ibdev). Lets udev/GID tooling resolve the peer from the
+ * netdev directly, now that it no longer parents to the XDomain device.
+ */
+static ssize_t tbv_peer_uuid_show(struct device *d,
+				  struct device_attribute *a, char *buf)
+{
+	struct tbv_ibdev *idev = dev_get_drvdata(d);
+
+	return sysfs_emit(buf, "%s\n", idev ? idev->peer_uuid : "");
+}
+static DEVICE_ATTR(tbv_peer_uuid, 0444, tbv_peer_uuid_show, NULL);
+
+static ssize_t tbv_peer_name_show(struct device *d,
+				  struct device_attribute *a, char *buf)
+{
+	struct tbv_ibdev *idev = dev_get_drvdata(d);
+
+	return sysfs_emit(buf, "%s\n", idev ? idev->peer_name : "");
+}
+static DEVICE_ATTR(tbv_peer_name, 0444, tbv_peer_name_show, NULL);
+
+static struct attribute *tbv_rail_netdev_attrs[] = {
+	&dev_attr_tbv_peer_uuid.attr,
+	&dev_attr_tbv_peer_name.attr,
+	NULL,
+};
+static const struct attribute_group tbv_rail_netdev_group = {
+	.attrs = tbv_rail_netdev_attrs,
+};
+
+struct device *tbv_ibdev_netdev_parent(struct device *ib_parent,
+				       struct tb_xdomain *xd)
+{
+	/*
+	 * Parent the per-rail GID netdev to the stable, driver-owned NHI/ring
+	 * device the ib_device already uses -- NOT the XDomain device. A direct
+	 * child of xd->dev is a sibling of the tb_services in xd->dev's child
+	 * list, so unregister_netdev() in our service .remove (called from
+	 * tb_xdomain_remove's device_for_each_child_reverse on peer disconnect)
+	 * mutates that list mid-iteration and NULL-derefs kernfs -- the crash
+	 * cascade of 2026-06-22. Decoupled, the netdev is torn down in order by
+	 * tbv_ibdev_detach_netdev() before its parent.
+	 */
+	(void)xd;
+	return ib_parent;
+}
+
 static int tbv_ibdev_attach_netdev(struct tbv_ibdev *dev)
 {
 	struct net_device *ndev;
@@ -2376,13 +2433,16 @@ static int tbv_ibdev_attach_netdev(struct tbv_ibdev *dev)
 	eth_hw_addr_set(ndev, mac);
 
 	/*
-	 * Parent to the per-link XDomain device (NOT the shared NHI ring device
-	 * that ib_device uses): it is unique per cabled neighbour and carries the
-	 * peer hostname in its `device_name` attribute, so udev can resolve the
-	 * peer and rename the netdev per link (mirrors thunderbolt_net).
+	 * Parent to the stable NHI/ring device the ib_device uses, NOT the
+	 * XDomain device: a netdev that is a direct child of xd->dev races
+	 * tb_xdomain_remove()'s child-list teardown on peer disconnect (see
+	 * tbv_ibdev_netdev_parent). udev/GID resolution of the peer now comes
+	 * from the netdev itself, not its parent device.
 	 */
-	if (dev->rail && dev->rail->peer && dev->rail->peer->xd)
-		SET_NETDEV_DEV(ndev, &dev->rail->peer->xd->dev);
+	SET_NETDEV_DEV(ndev,
+		       tbv_ibdev_netdev_parent(dev->base.dev.parent,
+			(dev->rail && dev->rail->peer) ? dev->rail->peer->xd :
+							 NULL));
 
 	ret = register_netdev(ndev);
 	if (ret) {
@@ -2405,6 +2465,22 @@ static int tbv_ibdev_attach_netdev(struct tbv_ibdev *dev)
 	 * from a warm reload (see drivers/thunderbolt/test.c icm_fw model), so a
 	 * load-time hang on these nodes is a driver-software fault, not the ICM.
 	 */
+	/* Copy peer identity from the XDomain and expose it on the netdev. */
+	{
+		struct tb_xdomain *xd = (dev->rail && dev->rail->peer) ?
+					dev->rail->peer->xd : NULL;
+
+		if (xd && xd->remote_uuid)
+			snprintf(dev->peer_uuid, sizeof(dev->peer_uuid), "%pUb",
+				 xd->remote_uuid);
+		if (xd && xd->device_name)
+			strscpy(dev->peer_name, xd->device_name,
+				sizeof(dev->peer_name));
+	}
+	dev_set_drvdata(&ndev->dev, dev);
+	if (sysfs_create_group(&ndev->dev.kobj, &tbv_rail_netdev_group))
+		pr_warn("rail netdev peer-attr group create failed\n");
+
 	netif_carrier_on(ndev);
 	dev->netdev = ndev;
 	return 0;
@@ -2418,6 +2494,7 @@ static void tbv_ibdev_detach_netdev(struct tbv_ibdev *dev)
 		return;
 
 	dev->netdev = NULL;
+	sysfs_remove_group(&ndev->dev.kobj, &tbv_rail_netdev_group);
 	ib_device_set_netdev(&dev->base, NULL, 1);
 	unregister_netdev(ndev);
 	free_netdev(ndev);

drivers/thunderbolt_ibverbs/kernel/tbv.h

@@ -872,6 +872,16 @@ int tbv_ibdev_rail_name_index(const struct tbv_rail *rail);
  * deadlocks (unregister_netdev under the rename's rtnl). Exposed for kunit.
  */
 bool tbv_netdev_rename_keep(const char *expected_name, const char *new_name);
+/*
+ * tbv_ibdev_netdev_parent returns the device the per-rail GID netdev must be
+ * parented to. It MUST be a stable, driver-owned device (the NHI/ring device the
+ * ib_device already uses, dev->base.dev.parent), NOT the XDomain device: the
+ * netdev must not be a direct child of xd->dev, or unregister_netdev() races
+ * tb_xdomain_remove()'s child-list iteration and NULL-derefs kernfs. Exposed for
+ * kunit.
+ */
+struct device *tbv_ibdev_netdev_parent(struct device *ib_parent,
+				       struct tb_xdomain *xd);
 bool tbv_gid_matches_identity(const u8 gid[16], u64 eui64, u32 ipv4_be);
 /*
  * tbv_gid_identity_verdict classifies a dgid against a stored peer identity.

drivers/thunderbolt_ibverbs/kernel/tests/ibdev_naming_test.c

@@ -106,13 +106,37 @@ static void tbv_rename_detach_pinned_diverged(struct kunit *test)
 	KUNIT_EXPECT_FALSE(test, tbv_netdev_rename_keep("br0.lan", "eth9"));
 }
 
+/*
+ * The per-rail GID netdev MUST NOT be parented to the XDomain device. xd->dev is
+ * owned/removed by the thunderbolt core; parenting the netdev there makes it a
+ * *sibling* of the tb_services in xd->dev's child list, so unregister_netdev()
+ * (in our service .remove, run from inside tb_xdomain_remove's
+ * device_for_each_child_reverse) mutates that child list mid-iteration ->
+ * kernfs_find_and_get_ns NULL deref -> chain-wide crash cascade on any neighbour
+ * disconnect (kdump appmana-002 2026-06-22). It must instead use the stable
+ * driver-owned NHI/ring device that the ib_device already parents to
+ * (dev->base.dev.parent), so its teardown is ordered and self-contained.
+ */
+static void tbv_netdev_parent_is_stable_not_xdomain(struct kunit *test)
+{
+	struct tb_xdomain xd = {0};
+	struct device nhi_dev = {0};	/* tb_ring_dma_device: stable, driver-owned */
+
+	/* red while it returns &xd.dev; green once it returns the stable parent */
+	KUNIT_EXPECT_PTR_NE(test,
+			    tbv_ibdev_netdev_parent(&nhi_dev, &xd), &xd.dev);
+	KUNIT_EXPECT_PTR_EQ(test,
+			    tbv_ibdev_netdev_parent(&nhi_dev, &xd), &nhi_dev);
+}
+
 static struct kunit_case tbv_ibdev_naming_test_cases[] = {
 	KUNIT_CASE(tbv_naming_two_neighbours_must_differ),
 	KUNIT_CASE(tbv_naming_lanes_disambiguate),
 	KUNIT_CASE(tbv_naming_errors),
 	KUNIT_CASE(tbv_rename_keep_own_gid_netdev),
 	KUNIT_CASE(tbv_rename_keep_pinned_match),
 	KUNIT_CASE(tbv_rename_detach_pinned_diverged),
+	KUNIT_CASE(tbv_netdev_parent_is_stable_not_xdomain),
 	{}
 };
 

drivers/thunderbolt_ibverbs/packaging/udev/tbv-rdma-addr

@@ -1,18 +1,14 @@
 #!/bin/sh
 # tbv-rdma-addr <ifname> -- assign the deterministic per-link routable /64 to a
 # usb4_rdma GID-only rail netdev, so both ends of a cabled link share a subnet.
-# Invoked from udev (RUN+=) after the rail netdev appears, and safe to re-run by
-# hand. Pure derivation lives in tbv-rdma-addr-lib.sh; this does the sysfs
-# lookups and the `ip` assignment.
+# Invoked from udev (RUN+=) and safe to re-run by hand. Pure derivation is in
+# tbv-rdma-addr-lib.sh; this does the sysfs lookups and the `ip` assignment.
 #
-# The rail netdev is parented (SET_NETDEV_DEV) to its XDomain *device* (e.g.
-# "0-1"), whose unique_id is the remote peer's host-router UUID. The local
-# host-router UUID is "<domain>-0" in the same thunderbolt domain. Both ends
-# therefore hold the same unordered UUID pair -> the same /64 (see the lib).
-#
-# udev renames the netdev (u4r<N> -> tbr-<peer>) BEFORE running RUN+=, so the
-# passed kernel name is stale by the time we run. We therefore resolve the live
-# interface from the stable XDomain parent device (via DEVPATH), not the name.
+# As of 0.2.15 the rail netdev parents to the stable NHI device (NOT the XDomain
+# device -- a direct child of xd->dev crashes on disconnect), so the peer UUID is
+# read from the netdev's own tbv_peer_uuid attribute, and the live interface is
+# resolved by the stable IFINDEX udev provides (robust to udev's concurrent
+# rename). The local host-router UUID is the same for every rail on the host.
 set -eu
 export PATH=/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-}
 
@@ -21,28 +17,26 @@ LIB="$(dirname "$0")/tbv-rdma-addr-lib.sh"
 . "$LIB"
 
 ifc="${1:-}"
-xdev=""
-# Prefer the passed name if it still resolves; else recover the XDomain parent
-# from DEVPATH (stable across the rename) and read the live name back out of it.
-if [ -n "$ifc" ] && [ -e "/sys/class/net/${ifc}/device" ]; then
-	xdev="$(readlink -f "/sys/class/net/${ifc}/device" 2>/dev/null || true)"
-elif [ -n "${DEVPATH:-}" ]; then
-	xdev="$(readlink -f "/sys${DEVPATH%/net/*}" 2>/dev/null || true)"
-	[ -n "$xdev" ] && ifc="$(ls "${xdev}/net" 2>/dev/null | head -n1)"
+# Resolve the live ifname by the stable ifindex (survives the udev rename).
+if [ -n "${IFINDEX:-}" ]; then
+	for f in /sys/class/net/*/ifindex; do
+		[ "$(cat "$f" 2>/dev/null)" = "$IFINDEX" ] || continue
+		ifc="$(basename "$(dirname "$f")")"
+		break
+	done
 fi
-[ -n "$xdev" ] && [ -n "$ifc" ] && [ -e "/sys/class/net/${ifc}" ] || exit 0
+[ -n "$ifc" ] && [ -e "/sys/class/net/${ifc}" ] || exit 0
 
-remote="$(cat "${xdev}/unique_id" 2>/dev/null || true)"
-[ -n "$remote" ] || exit 0                       # not an XDomain-parented rail
+remote="$(cat "/sys/class/net/${ifc}/tbv_peer_uuid" 2>/dev/null | tr -d '[:space:]')"
+[ -n "$remote" ] || exit 0			# not a tbv rail netdev
 
-domain="$(basename "$xdev")"; domain="${domain%%-*}"
-local="$(cat "/sys/bus/thunderbolt/devices/${domain}-0/unique_id" 2>/dev/null || true)"
+# local host-router UUID (identical for every rail on this host)
+local="$(cat /sys/bus/thunderbolt/devices/0-0/unique_id 2>/dev/null | tr -d '[:space:]')"
+[ -n "$local" ] || local="$(cat /sys/bus/thunderbolt/devices/*-0/unique_id 2>/dev/null | head -n1 | tr -d '[:space:]')"
 [ -n "$local" ] || exit 0
 
 addr="$(tbv_link_addr "$local" "$remote")"
 
-# nodad: link-local DAD is pointless on a point-to-point GID-only netdev and only
-# adds latency before the GID appears. `replace` keeps the helper idempotent.
 ip -6 addr replace "$addr" dev "$ifc" nodad 2>/dev/null || \
 	ip -6 addr replace "$addr" dev "$ifc"
 ip link set "$ifc" up

drivers/thunderbolt_ibverbs/packaging/udev/tbv-rdma-ifname

@@ -1,27 +1,32 @@
 #!/bin/sh
 # tbv-rdma-ifname: udev PROGRAM helper. Prints a stable, per-link name for the
-# usb4_rdma GID-only netdev that thunderbolt_ibverbs creates per rail. The name
-# is derived ONLY from what the kernel already exposes on the netdev's parent
-# XDomain device, so it needs NO site configuration and works on any host.
+# usb4_rdma GID-only netdev that thunderbolt_ibverbs creates per rail (kernel
+# name u4r<N>, enumeration-order and unstable).
 #
-# Naming priority (all from sysfs, none site-specific):
-#   1. tbr-<peer-hostname-tail>  -- device_name (peer kernel hostname)
-#   2. tbr-<peer-uuid-prefix>    -- unique_id (stable peer hardware UUID)
-#   3. (no rename)               -- keep the kernel's u4r<N> name
+# As of 0.2.15 the peer identity lives on the netdev itself (tbv_peer_name /
+# tbv_peer_uuid), because the netdev parents to the stable NHI device rather
+# than the XDomain device. Falls back to the parent XDomain attrs for older
+# (xd-parented) netdevs. Needs NO site configuration.
 #
-# Names are kept within the 15-char ifname limit ("tbr-" + up to 11).
+# Naming priority:
+#   1. tbr-<peer-hostname-tail>  -- peer kernel hostname
+#   2. tbr-<peer-uuid-prefix>    -- stable peer hardware UUID
+#   3. (no rename)               -- keep the kernel's u4r<N> name
+# Names stay within the 15-char ifname limit ("tbr-" + up to 11).
 set -u
 iface="${1:-}"
 [ -n "$iface" ] || exit 0
-dev="/sys/class/net/${iface}/device"
+nd="/sys/class/net/${iface}"
 
-host=$(cat "${dev}/device_name" 2>/dev/null | tr -cd 'A-Za-z0-9')
+host=$(cat "${nd}/tbv_peer_name" 2>/dev/null | tr -cd 'A-Za-z0-9')
+[ -n "$host" ] || host=$(cat "${nd}/device/device_name" 2>/dev/null | tr -cd 'A-Za-z0-9')
 if [ -n "$host" ]; then
 	printf 'tbr-%s' "$(printf '%s' "$host" | tail -c 11)"
 	exit 0
 fi
 
-uid=$(cat "${dev}/unique_id" 2>/dev/null | tr -cd '0-9a-f')
+uid=$(cat "${nd}/tbv_peer_uuid" 2>/dev/null | tr -cd '0-9a-f')
+[ -n "$uid" ] || uid=$(cat "${nd}/device/unique_id" 2>/dev/null | tr -cd '0-9a-f')
 if [ -n "$uid" ]; then
 	printf 'tbr-%s' "$(printf '%s' "$uid" | cut -c1-12)"
 	exit 0