From nobody Tue Dec 2 02:19:49 2025 Received: from mail-ed1-f42.google.com (mail-ed1-f42.google.com [209.85.208.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 50F9023F40C for ; Wed, 19 Nov 2025 16:08:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763568539; cv=none; b=LK2t1+076NggaCpLSXn7zud03BgkP+EiUlSSp5bFtP093xliaV0RojBGWeCnmnnAtw1j/kaZoQ3SBi6lTXTid8dCktmKNZq+u0UnuCXzZ9LgJ51gkTeY4lzPb5Jt4tB4EIF942kVUhav9Bq6JhZFT8QtY3PXuMCtbHl9AL7ELEc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763568539; c=relaxed/simple; bh=Z3cJOQ2ccJsQ0oWrL1rpG5fsyyBggDRUQgteyGwCcbM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=i3HO5402FK+/70/GAPx1rQbn3wc+Btvds0WP2CQPL/bAQO5hNQCV2Znrpbt9sZPlW3/e+uTAU+PXpdxWIZK5t+NHPL2q80ICfV/HkO24bf5pHSec2/k4TVtZ6KFDQLUdYmSglV+MUfypDAJU8B8xVqLV2J+EhBy5ttt8DEsZz8M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=AsZsQf2+; arc=none smtp.client-ip=209.85.208.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="AsZsQf2+" Received: by mail-ed1-f42.google.com with SMTP id 4fb4d7f45d1cf-641677916b5so11711577a12.0 for ; Wed, 19 Nov 2025 08:08:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1763568534; x=1764173334; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=SizZzBPjLKOoZAzPRbyBM42MsY16LLyvAwLNC6fcHOw=; b=AsZsQf2+kfGPGV3q17h1dhrrTg+T73pYWlEPIqm8v7yJ8Q7C+eGA7uVmk669W0YeIV ih6M+AYqUB3Vlu/DtW75lpdvs22ezYXQVRM4RebP/UtWkakTtudunTVKXVugICJTlnK0 BVzixu3i+DAde99cYSmFErdH/Gg90j8cVxYuxnXP1zkJG6ydij1/ctuTVCuUbc2+ZbWD VCfK0aoUYMjyKOPiIiz1ENH8+lDOHwaWGfyVh5k0CLEyHXUC9KpJfs/sI6J8CMN9c/Ja vRsJRZ5YqoyFVpl3AcTlgGGqzbeSOxsfUZZLGgLihtJqUzpQY3hxU3jvwD/1fAy4vfZS QIRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763568534; x=1764173334; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=SizZzBPjLKOoZAzPRbyBM42MsY16LLyvAwLNC6fcHOw=; b=cPjrCSE7ptGu4C8ftykVdaxRddJdNSYyaABNfjzzESyci7AEF5D7slqhV3CLkpKhIW ngEwZheS92SO2VuPCRyWRT9kNlk+PclnJebMIn+BmlesSYOgShid1D3pAJ0krvf2tIEU PFtWs6ftPTFDiD436EtO9ZUf6p4N+rSzNGbG2oNKwryQQ9gMBGpArvo8wVdKuMq20IN2 QUCH9B7MbJ+Aj26gj65jHJTbKa4rUhTtI+DCoXgrRBDVauLRVRHpvFyzRkfVzT6DP9vQ dp4rDRhogeDyaQHf65YysN8nZcF3DnW+t/9782IIsghLkuidC1WpImJUzHndoycNj57H F9cg== X-Forwarded-Encrypted: i=1; AJvYcCUJboHo8wXwLrfBerMHZJany/oeQMQUd9P6S8pTLUAqrlIOTvaJA7Eh1M855dOi1VQ1BP+zHVqzNDgwbBU=@vger.kernel.org X-Gm-Message-State: AOJu0YxCwwIzysFLnW8+sjYmN2q9buv7KiT8nhsEUs66Ozbi2ENtzsDu ckYlpHjpXOSwn1WNMB+wjxDT2A77DE02MXzbGqs4AHD8sVzny0CYKt5c X-Gm-Gg: ASbGncsHt/skfjdal+ijdz/QKLmfVmx+PxB+7Z9uT7i9p6i+3axkL4y5GtLxfvTxsjH 5ZUJOsZDHPkFJjD3EH5mrxV+FdGqcxUHSkKbp6IeJtr9KTtE993Zng9lQ7LVzPhnqcA26T7bc47 lqNVqI0vsVKItxuUBm1cR1tUtO3o9MMpp6Ed5iKPz0GehHlQUjt6Q20l4Y8ABfGK1pZhloSSUPP Yazfhz+IOEpKJLMIasHKTnSUO525Wu1kwYSDSgR4OkEAR4fd6YdKRj706kOEH2bLin8zIgAEUeu 1U4wRclDVxhwaILJeFjaREHtpaDyQq4Bcs2b6mtI+n0W/Sn29UC0AuA7P2neDCmwrHL91yyWaH8 hP+rhu8NxiwOdl22KhdfG7Jn+BVfFoIoZ+r/jJVJw1k8RDwII3ZBcO5LMP7Ov+B7tHK0RnPE0P3 f4CG3OQwT9iK8w6bFISXEvng== X-Google-Smtp-Source: AGHT+IH2cx6mffoyjgk5HxK/FEYr6BIhhOy7D3Vvb4brj04ZDUMSv4/MBmhJNb8U2haI1icmHHq8Iw== X-Received: by 2002:a17:906:794d:b0:b73:1905:bba0 with SMTP id a640c23a62f3a-b7637869c14mr374006666b.17.1763568533551; Wed, 19 Nov 2025 08:08:53 -0800 (PST) Received: from localhost.localdomain ([46.10.223.24]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-b734fad45afsm1657863166b.24.2025.11.19.08.08.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Nov 2025 08:08:53 -0800 (PST) From: "Nikola Z. Ivanov" To: jiri@resnulli.us, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, skhan@linuxfoundation.org, david.hunter.linux@gmail.com, khalid@kernel.org, linux-kernel-mentees@lists.linuxfoundation.org, "Nikola Z. Ivanov" , syzbot+a2a3b519de727b0f7903@syzkaller.appspotmail.com Subject: [PATCH net v3] team: Move team device type change at the end of team_port_add Date: Wed, 19 Nov 2025 18:08:50 +0200 Message-ID: <20251119160850.378824-1-zlatistiv@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Attempting to add a port device that is already up will expectedly fail, but not before modifying the team device header_ops. In the case of the syzbot reproducer the gre0 device is already in state UP when it attempts to add it as a port device of team0, this fails but before that header_ops->create of team0 is changed from eth_header to ipgre_header in the call to team_dev_type_check_change. Later when we end up in ipgre_header() struct ip_tunnel* points to nonsense as the private data of the device still holds a struct team. Example sequence of iproute2 commands to reproduce the hang/BUG(): ip link add dev team0 type team ip link add dev gre0 type gre ip link set dev gre0 up ip link set dev gre0 master team0 ip link set dev team0 up ping -I team0 1.1.1.1 Move team_dev_type_check_change down where all other checks have passed as it changes the dev type with no way to restore it in case one of the checks that follow it fail. Also make sure to preserve the origial mtu assignment: - If port_dev is not the same type as dev, dev takes mtu from port_dev - If port_dev is the same type as dev, port_dev takes mtu from dev Testing: - team device driver in-tree selftests - Add/remove various devices as slaves of team device - syzbot Reported-by: syzbot+a2a3b519de727b0f7903@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3Da2a3b519de727b0f7903 Fixes: 1d76efe1577b ("team: add support for non-ethernet devices") Signed-off-by: Nikola Z. Ivanov --- Changes since v1: - Add a "Fixes" tag - Add a simple reproducer in the commit log https://lore.kernel.org/netdev/20251111171341.4c6d69be@kernel.org/T/#u Changes since v2: - Use already present exit label "err_set_slave_promisc" for returning on failure of team_dev_type_check_change. This was suggested in the initial patch thread (v1). https://lore.kernel.org/netdev/20251113211142.245216-1-zlatistiv@gmail.co= m/ drivers/net/team/team_core.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c index 17f07eb0ee52..d7625a390e94 100644 --- a/drivers/net/team/team_core.c +++ b/drivers/net/team/team_core.c @@ -1191,10 +1191,6 @@ static int team_port_add(struct team *team, struct n= et_device *port_dev, return -EPERM; } =20 - err =3D team_dev_type_check_change(dev, port_dev); - if (err) - return err; - if (port_dev->flags & IFF_UP) { NL_SET_ERR_MSG(extack, "Device is up. Set it down before adding it as a = team port"); netdev_err(dev, "Device %s is up. Set it down before adding it as a team= port\n", @@ -1212,10 +1208,12 @@ static int team_port_add(struct team *team, struct = net_device *port_dev, INIT_LIST_HEAD(&port->qom_list); =20 port->orig.mtu =3D port_dev->mtu; - err =3D dev_set_mtu(port_dev, dev->mtu); - if (err) { - netdev_dbg(dev, "Error %d calling dev_set_mtu\n", err); - goto err_set_mtu; + if (dev->type =3D=3D port_dev->type) { + err =3D dev_set_mtu(port_dev, dev->mtu); + if (err) { + netdev_dbg(dev, "Error %d calling dev_set_mtu\n", err); + goto err_set_mtu; + } } =20 memcpy(port->orig.dev_addr, port_dev->dev_addr, port_dev->addr_len); @@ -1290,6 +1288,10 @@ static int team_port_add(struct team *team, struct n= et_device *port_dev, } } =20 + err =3D team_dev_type_check_change(dev, port_dev); + if (err) + goto err_set_slave_promisc; + if (dev->flags & IFF_UP) { netif_addr_lock_bh(dev); dev_uc_sync_multiple(port_dev, dev); --=20 2.51.0