Re: [PATCH] team: fix promisc/allmulti leak in team_port_add error path

[netdev-bot+sashiko@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue(s) to consider.

Critical: 0 · High: 0 · Medium: 1 · Low: 0

If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).

- [Medium] The patch has the wrong Fixes: tag.

--

team: fix promisc/allmulti leak in team_port_add error path

This commit undoes the port's promiscuity and allmulti increments on the
err_set_dev_type path of team_port_add() in drivers/net/team/team_core.c.
Before this change, that path left both increments in place when
team_dev_type_check_change() failed.

> Fixes: 43c2adb9df7d ("team: set slave to promisc if team is already in promisc mode")

[Severity: Medium]
Is this the right commit for the Fixes: tag?

Before commit 0ae9cfc454ea ("team: Move team device type change at the
end of team_port_add"), team_port_add() called
team_dev_type_check_change() near the top of the function. That was
before the port was allocated or promisc/allmulti was raised, and a
failure there just did a plain return err. So in trees from 43c2adb9df7d
up to 0ae9cfc454ea, no increment exists yet when the type check fails.

Commit 0ae9cfc454ea moved the call below the promisc/allmulti block and
added the err_set_dev_type label. That label falls straight through to
the other labels:

    err = team_dev_type_check_change(dev, port_dev);
    if (err)
        goto err_set_dev_type;
    ...
err_set_dev_type:
err_set_slave_allmulti:
err_set_slave_promisc:
    __team_option_inst_del_port(team, port);

This sentence in the commit message is therefore only true from
0ae9cfc454ea onward:

> team_port_add() increments the port's promiscuity and allmulti
> counts before calling team_dev_type_check_change().

Trees that have 43c2adb9df7d but not 0ae9cfc454ea have no
err_set_dev_type label, so a stable backport based on the current tag
would not apply there.

Should the tag be the following instead?

Fixes: 0ae9cfc454ea ("team: Move team device type change at the end of team_port_add")

The code change itself looks correct. It matches the cleanup in
team_port_del().

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261019083122.1841-1-lirongqing%40baidu.com