From nobody Tue Dec 2 01:04:51 2025 Received: from mail-ej1-f46.google.com (mail-ej1-f46.google.com [209.85.218.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 944D443147 for ; Sat, 22 Nov 2025 00:20:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763770834; cv=none; b=af3W+uMbDRTG/mljZ7iRg9QHIxULEV+z7CVBTs8QhqUp1HnZOGZyxfX1E1oQF3c6hDASycbszvZz75rg8cCRIwcA1X17Sf7gOrMuEkguF0kEyOR0GYEpLX1ZuIq1rc7QJXg0sv0Oxilsor9G3BKy+uGMOUyhfq5deTqU2SWo1aM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763770834; c=relaxed/simple; bh=rJoQQQVl3A5OBD0qoQTUH/HKulcN+Tm1hu8kr4bTSys=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Qz2n+nQbEt0epXZTP4xfcbMxk8Ymi0r2/0UMT5yscP5ivFGlH6UbN07DcyRcXwA0CrYsoKiM0pR0y/ZB+jvfnEC0rjQG1W+jfs53u7NcOqKU3eW4DNOgUi2ftbnL4LIdlQOhgjsrs+Q07TG0mCQyZqnTBVKhhtJRg9fDl1NZ1Uw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=XCUc5XHM; arc=none smtp.client-ip=209.85.218.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="XCUc5XHM" Received: by mail-ej1-f46.google.com with SMTP id a640c23a62f3a-b736d883ac4so476896666b.2 for ; Fri, 21 Nov 2025 16:20:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1763770831; x=1764375631; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=zAp9aZ+uW/j52RhXFBcyoCAsa70B/Y4OxqM/BiEieGk=; b=XCUc5XHMdo/UT5SHXibYM9seqnIrEGRDdnYdbz2+d/eup+gjdIsvG/V1O7HTfoDAJe KFGa9C2y9jhfbz1d4wQHiBLFiO+MNguBnHaZ9EDm/W6wTzC7Dy4++EFPPPzSD0esAouA UxwSGvAtBGPyd00HFXChWKZQe4S0x2IQZVALwFrbBwW8VB17Hqk7JF3sdAL28gEwgEo+ 8ZBfrNuiAZWLCah3Mx40CedHhedZVBGR3pGhrbZBUJ3XEz4u/KMcKALxbdKcOY0rLZy7 /EBhUflfCZUk3Vd5ESeXRcKe8RAx2CFX1S5ot/HlaU8RfqOTWnBAvUW3trr+UioLP8Kd oB0w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763770831; x=1764375631; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=zAp9aZ+uW/j52RhXFBcyoCAsa70B/Y4OxqM/BiEieGk=; b=eHKNg3QagLyc7Yuw72amA9TDST9kTkjD7UInrinuPg7y8SAlI/jCyBP/hBucDWbDkT nql48Vjv+Wrh/eqNY/2F8mSEiWiozhDUMjRRNcSFw8lZn/ZQl7fxKD6KFEzldet2MPRC c3kffo6pZ41cHa3m8wxv/bVhDcfejC0irNYYhISDE0VuhzSaiEDa2d4MopcSD5tYO4dk 9fArT17sJmJYZNi0GD8VYa9wXtr2K5rDsgLiw6p3dnq1y1Y1IVw52E/iS/5LXh6CNvdt 6UPHiR4MqdjxI2DMF9YMWhw79IEEFt2qnURWDm6zSu8H6FgkRHM8QciJAxUG6ZlZ3da7 TD5w== X-Forwarded-Encrypted: i=1; AJvYcCUjYN4tr8xx4cE3GIua245/wzDV4J50nARY0oMV+q9tL3wT5JMZuH+AwcWVbvxmN1H9VGGk3LER94NmEF4=@vger.kernel.org X-Gm-Message-State: AOJu0YwvS6vmmDGOXmCvYgrluz4k/HCs3T02gENgj69GCh66TUfH66u3 ByzouccWW/UINuPtcCJij7IFry9nN5IWHU3YroJg7BdWSRlsGM6LGDTa X-Gm-Gg: ASbGncvqXIcY0zFCMgSHdegpOObifE3eiImqvkOssr010vA3KMJUu1okbIhnVT288/B a3ByQ1Dd2OlSngWbdIswfNSZ0qPXmzVOQ+tzd+E2kDrctWWAzhd1D8Jfn1Ge3MPrOEryynjEzV3 Uuuy3iP068QukZyr1FhhgvbxGqXwE2/Mw+0y+3/Wn59DdemjHNnMD2RDfSyHJgTzYwtNa07yyj2 P9ha5o3PH9eI3QWiLKnvbLtIsD7JDnBfIJgkI+Nc/oEkZDFlsJyHXS4bXb4clv3bgF1Z7K/JB8O iqJ8EoYYcJtE3JXSjtieSfOkeXV2AjtLue8a9uJEDHnlNOiwehoInD8FCLKWOpRDUNGAVTE9okr D8lTFrL44x6XdwY+WK908ge0D1qjZ9OFG7/m5OakWoYuF9PknRLAysrgquWyHGU5va3EcR2OAMa LkA4rSWaR/AF6gb3qiAOoN/Q== X-Google-Smtp-Source: AGHT+IHwH08qVkgII6zjFUUDK4LO3V9/FMSKTA0oD9d0P7wNSGNESnDtmGP1YSKgkzGu1UoXEaV5TQ== X-Received: by 2002:a17:907:3f1e:b0:b73:5acd:465e with SMTP id a640c23a62f3a-b767153ee39mr438247666b.11.1763770830585; Fri, 21 Nov 2025 16:20:30 -0800 (PST) Received: from localhost.localdomain ([46.10.223.24]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-b7654fd6087sm587410466b.44.2025.11.21.16.20.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 21 Nov 2025 16:20:29 -0800 (PST) From: "Nikola Z. Ivanov" To: jiri@resnulli.us, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, skhan@linuxfoundation.org, david.hunter.linux@gmail.com, khalid@kernel.org, linux-kernel-mentees@lists.linuxfoundation.org, "Nikola Z. Ivanov" , syzbot+a2a3b519de727b0f7903@syzkaller.appspotmail.com Subject: [PATCH net v4] team: Move team device type change at the end of team_port_add Date: Sat, 22 Nov 2025 02:20:27 +0200 Message-ID: <20251122002027.695151-1-zlatistiv@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Attempting to add a port device that is already up will expectedly fail, but not before modifying the team device header_ops. In the case of the syzbot reproducer the gre0 device is already in state UP when it attempts to add it as a port device of team0, this fails but before that header_ops->create of team0 is changed from eth_header to ipgre_header in the call to team_dev_type_check_change. Later when we end up in ipgre_header() struct ip_tunnel* points to nonsense as the private data of the device still holds a struct team. Example sequence of iproute2 commands to reproduce the hang/BUG(): ip link add dev team0 type team ip link add dev gre0 type gre ip link set dev gre0 up ip link set dev gre0 master team0 ip link set dev team0 up ping -I team0 1.1.1.1 Move team_dev_type_check_change down where all other checks have passed as it changes the dev type with no way to restore it in case one of the checks that follow it fail. Also make sure to preserve the origial mtu assignment: - If port_dev is not the same type as dev, dev takes mtu from port_dev - If port_dev is the same type as dev, port_dev takes mtu from dev This is done by adding a conditional before the call to dev_set_mtu to prevent it from assigning port_dev->mtu =3D dev->mtu and instead letting team_dev_type_check_change assign dev->mtu =3D port_dev->mtu. The conditional is needed because the patch moves the call to team_dev_type_check_change past dev_set_mtu. Testing: - team device driver in-tree selftests - Add/remove various devices as slaves of team device - syzbot Reported-by: syzbot+a2a3b519de727b0f7903@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3Da2a3b519de727b0f7903 Fixes: 1d76efe1577b ("team: add support for non-ethernet devices") Signed-off-by: Nikola Z. Ivanov Reviewed-by: Jiri Pirko --- Changes since v1: - Add a "Fixes" tag - Add a simple reproducer in the commit log https://lore.kernel.org/netdev/20251111171341.4c6d69be@kernel.org/T/#u Changes since v2: - Use already present exit label "err_set_slave_promisc" for returning on failure of team_dev_type_check_change. This was suggested in the initial patch thread (v1). https://lore.kernel.org/netdev/20251113211142.245216-1-zlatistiv@gmail.co= m/ Changes since v3: - Revert the change in v3 related to reusing exit label. - Add a brief comment before the conditional call to dev_set_mtu. - Add more descriptive commit message related to the conditional. https://lore.kernel.org/netdev/20251119160850.378824-1-zlatistiv@gmail.co= m/ drivers/net/team/team_core.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c index 17f07eb0ee52..25562b17debe 100644 --- a/drivers/net/team/team_core.c +++ b/drivers/net/team/team_core.c @@ -1191,10 +1191,6 @@ static int team_port_add(struct team *team, struct n= et_device *port_dev, return -EPERM; } =20 - err =3D team_dev_type_check_change(dev, port_dev); - if (err) - return err; - if (port_dev->flags & IFF_UP) { NL_SET_ERR_MSG(extack, "Device is up. Set it down before adding it as a = team port"); netdev_err(dev, "Device %s is up. Set it down before adding it as a team= port\n", @@ -1212,10 +1208,16 @@ static int team_port_add(struct team *team, struct = net_device *port_dev, INIT_LIST_HEAD(&port->qom_list); =20 port->orig.mtu =3D port_dev->mtu; - err =3D dev_set_mtu(port_dev, dev->mtu); - if (err) { - netdev_dbg(dev, "Error %d calling dev_set_mtu\n", err); - goto err_set_mtu; + /* + * MTU assignment will be handled in team_dev_type_check_change + * if dev and port_dev are of different types + */ + if (dev->type =3D=3D port_dev->type) { + err =3D dev_set_mtu(port_dev, dev->mtu); + if (err) { + netdev_dbg(dev, "Error %d calling dev_set_mtu\n", err); + goto err_set_mtu; + } } =20 memcpy(port->orig.dev_addr, port_dev->dev_addr, port_dev->addr_len); @@ -1290,6 +1292,10 @@ static int team_port_add(struct team *team, struct n= et_device *port_dev, } } =20 + err =3D team_dev_type_check_change(dev, port_dev); + if (err) + goto err_set_dev_type; + if (dev->flags & IFF_UP) { netif_addr_lock_bh(dev); dev_uc_sync_multiple(port_dev, dev); @@ -1308,6 +1314,7 @@ static int team_port_add(struct team *team, struct ne= t_device *port_dev, =20 return 0; =20 +err_set_dev_type: err_set_slave_promisc: __team_option_inst_del_port(team, port); =20 --=20 2.51.0