From nobody Sun Feb 8 18:32:05 2026 Received: from mail-ej1-f54.google.com (mail-ej1-f54.google.com [209.85.218.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B2D1830F923 for ; Thu, 13 Nov 2025 21:12:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.54 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763068331; cv=none; b=mTmhjiU5FYR5wVy3fA27IfUGTdPKST3oRWW0KNlXESfZ4L08syaj4KihJSmXRA3N9chBPec/JNczaZtcKqstz22VAPGe1Jabx73WxhRiMuxHG088pJArM8ib8AKIsZ8e6Q4goL80ASGiAWLSMtQcU69WONr8gP+pVNzh025K/DU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763068331; c=relaxed/simple; bh=VZz8VeGMD34/0SPFsGJY9Zec9mHyRzTy7RjCb0SFz3Y=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=qMvkuQZZTVY1TBf09OtBMAs4oL1+MFBAeYKjMZ4H8GxRU6hP1etGeHOa4EANwR1FxaYxxU6N3YKGGsoT8WUTmx21X0tXCKoHcvu7F3oQuwApEqBapgCxbtO+ys+/L+Z+3rT8PTHW8zaT33bk5AP5m6pejL5FPKOve755NVEkmvs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=kE9AvMS2; arc=none smtp.client-ip=209.85.218.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="kE9AvMS2" Received: by mail-ej1-f54.google.com with SMTP id a640c23a62f3a-b72cbc24637so226626066b.0 for ; Thu, 13 Nov 2025 13:12:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1763068328; x=1763673128; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=wyeY2XNsdqhfXocUSjoPZjzq+oQsyNbMvmr9wItdoUQ=; b=kE9AvMS2cfy+EA9GgKflu/RE3Cuibbu3f1mIhyrSwE8uj2A7XaBfJ20NM3UtQCJ739 j/jS01VHINekHbMhjxMlr+U/pE/0OfVXF+5EO4tC3PhgNJBYiOFIHGlZj4wNfGbza5mM T5yog6Lprd0mOTVHCNEm5J8I4+jGySsNVIq7QBhkwFW8KNROXJ+PgUlEWhH1ub3tnb6e gq/92o89EpH2L7udLImGxdVqT01UVSHb/OBI8Kt+nu0Xk7kzI7wrlHAKSWkUcBRU+2Nf KOr+8MpyYIX55vdmugskd6H1wHmi2ZN29O7O0+CCJDVuTygVO968bFuMF42DZ8+rcFEN 06ew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763068328; x=1763673128; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=wyeY2XNsdqhfXocUSjoPZjzq+oQsyNbMvmr9wItdoUQ=; b=F8txUZh0Ps9bGHQmrzcjEbRUEG8aHPzKstgae8paeEJ/WlOO6NyErBDKbTUrDLYjHE UXRc4o7TAGNgQO6uZMhTBrSZqIkJLBXoUjxmxFLT53UIrxBV/CTAPlP6RUfm14OhOjkS f9ryY7SfNleE6jgI40kXfiNiHA0PKvF4bCeWCKMOHjfCl0eV63m4ZYMF/iN5bWYH5uco HiLxFL2I1bC59WctSW/AqcowyN8fwICXcPvpKE8nnlb4LcSXkYzmcMveBPBoXQ2V1a2V 76vnzgNZD/+lGpP603pkkAKepowC6a5SDoxB6Rz7o4W1HvaaJss7iGLLTGhW1gKvkOce 08AQ== X-Forwarded-Encrypted: i=1; AJvYcCWYoXeOa68T5hWw3kfSM7odkcZrL1Y7Q/eyIYkj2pBI9LyGuKteGnNjugE48gSRXDo26XPvRjGrnePAlYA=@vger.kernel.org X-Gm-Message-State: AOJu0YyutTyLGpBX74/L3R6jLa2ZUjGIv8Iy60WFNxidLwbETg6kgb9Q VxLdIYj/oH8SJ9ge99Ugc4a7MbHbU9pzlve0/X5dHLtengrppy5997jM X-Gm-Gg: ASbGncvjKml7WDIn0Eve17pUDxKkGek+CWCpeMXP6UejY32Aft+kDHfZqqdECRbhOwu fmYTDWPO90ysUOTO53csZVzZwUNdf8LX6qMXnKN+/UCAFYQ/LPic0MMKF2/K8W0sfq9Z57gUf9g OXjn+LHM+Mae2nfgwJ7jlJouzF+kFR/wPN1ld88lMm/vSNG8YkkxxvsVyQE8JiiHUl62e+CRHLV JFDFj3UOP+CqvAXjaJmoMLcEhAxqDmxVYYWvUGDZHAy5ndXkB/Lo3eGqZQWGIixQhB9P8OKQEPl h0DhiERI2ixCfxZvvJ+Tp4fIn/5xingCdCSQ1oySlOXpAiwV0x7952uwYq0ByY5ZagUkRrsgJR9 ckXM+P8zxa9Dm5OaKmrEar+FULMxXRePXPZUtRXB7bdMoWoBJJK7wehmjjiiEAuJKdn2A8TBxke OjLpSdg71diXY= X-Google-Smtp-Source: AGHT+IHiDc/7hf9TqjsuwSPQ+FK0WK3MXANc1n+4UzxCZWDV8N5JWcs8yaQjBqEdwkwAyS0qmrlBJg== X-Received: by 2002:a17:907:60d4:b0:b6d:5914:30c with SMTP id a640c23a62f3a-b73679841a7mr52617866b.34.1763068327739; Thu, 13 Nov 2025 13:12:07 -0800 (PST) Received: from localhost.localdomain ([46.10.223.24]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-b734fda8d69sm237324266b.50.2025.11.13.13.12.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 13 Nov 2025 13:12:07 -0800 (PST) From: "Nikola Z. Ivanov" To: jiri@resnulli.us, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, skhan@linuxfoundation.org, david.hunter.linux@gmail.com, khalid@kernel.org, linux-kernel-mentees@lists.linuxfoundation.org, "Nikola Z. Ivanov" , syzbot+a2a3b519de727b0f7903@syzkaller.appspotmail.com Subject: [PATCH net v2] team: Move team device type change at the end of team_port_add Date: Thu, 13 Nov 2025 23:11:42 +0200 Message-ID: <20251113211142.245216-1-zlatistiv@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Attempting to add a port device that is already up will expectedly fail, but not before modifying the team device header_ops. In the case of the syzbot reproducer the gre0 device is already in state UP when it attempts to add it as a port device of team0, this fails but before that header_ops->create of team0 is changed from eth_header to ipgre_header in the call to team_dev_type_check_change. Later when we end up in ipgre_header() struct *ip_tunnel points to nonsense as the private data of the device still holds a struct team. Example sequence of iproute commands to reproduce the hang/BUG(): ip link add dev team0 type team ip link add dev gre0 type gre ip link set dev gre0 up ip link set dev gre0 master team0 ip link set dev team0 up ping -I team0 1.1.1.1 Move team_dev_type_check_change down where all other checks have passed as it changes the dev type with no way to restore it in case one of the checks that follow it fail. Also make sure to preserve the origial mtu assignment: - If port_dev is not the same type as dev, dev takes mtu from port_dev - If port_dev is the same type as dev, port_dev takes mtu from dev Testing: - team device driver in-tree selftests - Add/remove various devices as slaves of team device - syzbot Reported-by: syzbot+a2a3b519de727b0f7903@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3Da2a3b519de727b0f7903 Fixes: 1d76efe1577b ("team: add support for non-ethernet devices") Signed-off-by: Nikola Z. Ivanov --- Changes since v1: - Add a "Fixes" tag - Add a simple reproducer in the commit log https://lore.kernel.org/netdev/20251111171341.4c6d69be@kernel.org/T/#u drivers/net/team/team_core.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c index 29dc04c299a3..94c149e89231 100644 --- a/drivers/net/team/team_core.c +++ b/drivers/net/team/team_core.c @@ -1134,10 +1134,6 @@ static int team_port_add(struct team *team, struct n= et_device *port_dev, return -EPERM; } =20 - err =3D team_dev_type_check_change(dev, port_dev); - if (err) - return err; - if (port_dev->flags & IFF_UP) { NL_SET_ERR_MSG(extack, "Device is up. Set it down before adding it as a = team port"); netdev_err(dev, "Device %s is up. Set it down before adding it as a team= port\n", @@ -1155,10 +1151,12 @@ static int team_port_add(struct team *team, struct = net_device *port_dev, INIT_LIST_HEAD(&port->qom_list); =20 port->orig.mtu =3D port_dev->mtu; - err =3D dev_set_mtu(port_dev, dev->mtu); - if (err) { - netdev_dbg(dev, "Error %d calling dev_set_mtu\n", err); - goto err_set_mtu; + if (dev->type =3D=3D port_dev->type) { + err =3D dev_set_mtu(port_dev, dev->mtu); + if (err) { + netdev_dbg(dev, "Error %d calling dev_set_mtu\n", err); + goto err_set_mtu; + } } =20 memcpy(port->orig.dev_addr, port_dev->dev_addr, port_dev->addr_len); @@ -1233,6 +1231,10 @@ static int team_port_add(struct team *team, struct n= et_device *port_dev, } } =20 + err =3D team_dev_type_check_change(dev, port_dev); + if (err) + goto err_set_dev_type; + if (dev->flags & IFF_UP) { netif_addr_lock_bh(dev); dev_uc_sync_multiple(port_dev, dev); @@ -1251,6 +1253,7 @@ static int team_port_add(struct team *team, struct ne= t_device *port_dev, =20 return 0; =20 +err_set_dev_type: err_set_slave_promisc: __team_option_inst_del_port(team, port); =20 --=20 2.51.0