[PATCH net v2] team: avoid NETDEV_CHANGEMTU event when unregistering slave

[PATCH net v2] team: avoid NETDEV_CHANGEMTU event when unregistering slave

[Tetsuo Handa]

syzbot is reporting

  unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 3
  ref_tracker: netdev@ffff88807dcf8618 has 1/2 users at
       __netdev_tracker_alloc include/linux/netdevice.h:4400 [inline]
       netdev_hold include/linux/netdevice.h:4429 [inline]
       inetdev_init+0x201/0x4e0 net/ipv4/devinet.c:286
       inetdev_event+0x251/0x1610 net/ipv4/devinet.c:1600
       notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
       call_netdevice_notifiers_mtu net/core/dev.c:2318 [inline]
       netif_set_mtu_ext+0x5aa/0x800 net/core/dev.c:9886
       netif_set_mtu+0xd7/0x1b0 net/core/dev.c:9907
       dev_set_mtu+0x126/0x260 net/core/dev_api.c:248
       team_port_del+0xb07/0xcb0 drivers/net/team/team_core.c:1333
       team_del_slave drivers/net/team/team_core.c:1936 [inline]
       team_device_event+0x207/0x5b0 drivers/net/team/team_core.c:2929
       notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
       call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
       call_netdevice_notifiers net/core/dev.c:2295 [inline]
       __dev_change_net_namespace+0xcb7/0x2050 net/core/dev.c:12592
       do_setlink+0x2ce/0x4590 net/core/rtnetlink.c:3060
       rtnl_changelink net/core/rtnetlink.c:3776 [inline]
       __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
       rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
       rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
       netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
       netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
       netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
       netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894

problem. Ido Schimmel found steps to reproduce

  ip link add name team1 type team
  ip link add name dummy1 mtu 1499 master team1 type dummy
  ip netns add ns1
  ip link set dev dummy1 netns ns1
  ip -n ns1 link del dev dummy1

and also found that the same issue was fixed in the bond driver in
commit f51048c3e07b ("bonding: avoid NETDEV_CHANGEMTU event when
unregistering slave").

Let's do similar thing for the team driver, with commit ad7c7b2172c3 ("net:
hold netdev instance lock during sysfs operations") and commit 303a8487a657
("net: s/__dev_set_mtu/__netif_set_mtu/") also applied.

Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
Suggested-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
---
v2:
  - Added Reviewed-by: and Fixes: tag.
  - Added MODULE_IMPORT_NS() line.

v1:
  - https://lkml.kernel.org/r/ece4365f-906c-44e2-80c9-ab73f91f7fb5@I-love.SAKURA.ne.jp

 drivers/net/team/team_core.c | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
index c08a5c1bd6e4..a0fe998cc055 100644
--- a/drivers/net/team/team_core.c
+++ b/drivers/net/team/team_core.c
@@ -1292,7 +1292,7 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
 
 static void __team_port_change_port_removed(struct team_port *port);
 
-static int team_port_del(struct team *team, struct net_device *port_dev)
+static int team_port_del(struct team *team, struct net_device *port_dev, bool unregister)
 {
 	struct net_device *dev = team->dev;
 	struct team_port *port;
@@ -1330,7 +1330,13 @@ static int team_port_del(struct team *team, struct net_device *port_dev)
 	__team_port_change_port_removed(port);
 
 	team_port_set_orig_dev_addr(port);
-	dev_set_mtu(port_dev, port->orig.mtu);
+	if (unregister) {
+		netdev_lock_ops(port_dev);
+		__netif_set_mtu(port_dev, port->orig.mtu);
+		netdev_unlock_ops(port_dev);
+	} else {
+		dev_set_mtu(port_dev, port->orig.mtu);
+	}
 	kfree_rcu(port, rcu);
 	netdev_info(dev, "Port device %s removed\n", portname);
 	netdev_compute_master_upper_features(team->dev, true);
@@ -1634,7 +1640,7 @@ static void team_uninit(struct net_device *dev)
 	ASSERT_RTNL();
 
 	list_for_each_entry_safe(port, tmp, &team->port_list, list)
-		team_port_del(team, port->dev);
+		team_port_del(team, port->dev, false);
 
 	__team_change_mode(team, NULL); /* cleanup */
 	__team_options_unregister(team, team_options, ARRAY_SIZE(team_options));
@@ -1933,7 +1939,16 @@ static int team_del_slave(struct net_device *dev, struct net_device *port_dev)
 
 	ASSERT_RTNL();
 
-	return team_port_del(team, port_dev);
+	return team_port_del(team, port_dev, false);
+}
+
+static int team_del_slave_on_unregister(struct net_device *dev, struct net_device *port_dev)
+{
+	struct team *team = netdev_priv(dev);
+
+	ASSERT_RTNL();
+
+	return team_port_del(team, port_dev, true);
 }
 
 static netdev_features_t team_fix_features(struct net_device *dev,
@@ -2926,7 +2941,7 @@ static int team_device_event(struct notifier_block *unused,
 					       !!netif_oper_up(port->dev));
 		break;
 	case NETDEV_UNREGISTER:
-		team_del_slave(port->team->dev, dev);
+		team_del_slave_on_unregister(port->team->dev, dev);
 		break;
 	case NETDEV_FEAT_CHANGE:
 		if (!port->team->notifier_ctx) {
@@ -2999,3 +3014,4 @@ MODULE_LICENSE("GPL v2");
 MODULE_AUTHOR("Jiri Pirko <jpirko@redhat.com>");
 MODULE_DESCRIPTION("Ethernet team device driver");
 MODULE_ALIAS_RTNL_LINK(DRV_NAME);
+MODULE_IMPORT_NS("NETDEV_INTERNAL");
-- 
2.47.3

Re: [PATCH net v2] team: avoid NETDEV_CHANGEMTU event when unregistering slave

[Stanislav Fomichev]

On 01/27, Tetsuo Handa wrote:
> syzbot is reporting
> 
>   unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 3
>   ref_tracker: netdev@ffff88807dcf8618 has 1/2 users at
>        __netdev_tracker_alloc include/linux/netdevice.h:4400 [inline]
>        netdev_hold include/linux/netdevice.h:4429 [inline]
>        inetdev_init+0x201/0x4e0 net/ipv4/devinet.c:286
>        inetdev_event+0x251/0x1610 net/ipv4/devinet.c:1600
>        notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
>        call_netdevice_notifiers_mtu net/core/dev.c:2318 [inline]
>        netif_set_mtu_ext+0x5aa/0x800 net/core/dev.c:9886
>        netif_set_mtu+0xd7/0x1b0 net/core/dev.c:9907
>        dev_set_mtu+0x126/0x260 net/core/dev_api.c:248
>        team_port_del+0xb07/0xcb0 drivers/net/team/team_core.c:1333
>        team_del_slave drivers/net/team/team_core.c:1936 [inline]
>        team_device_event+0x207/0x5b0 drivers/net/team/team_core.c:2929
>        notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
>        call_netdevice_notifiers_extack net/core/dev.c:2281 [inline]
>        call_netdevice_notifiers net/core/dev.c:2295 [inline]
>        __dev_change_net_namespace+0xcb7/0x2050 net/core/dev.c:12592
>        do_setlink+0x2ce/0x4590 net/core/rtnetlink.c:3060
>        rtnl_changelink net/core/rtnetlink.c:3776 [inline]
>        __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
>        rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
>        rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
>        netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
>        netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
>        netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
>        netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
> 
> problem. Ido Schimmel found steps to reproduce
> 
>   ip link add name team1 type team
>   ip link add name dummy1 mtu 1499 master team1 type dummy
>   ip netns add ns1
>   ip link set dev dummy1 netns ns1
>   ip -n ns1 link del dev dummy1

Can we add the above as a selftest to
tools/testing/selftests/net/rtnetlink.sh? I was adding the quirky ones
(like kci_test_macsec_vlan) over there.. Or maybe something under
selftests/drivers/net/team/ ?

Re: [PATCH net v2] team: avoid NETDEV_CHANGEMTU event when unregistering slave

[Jakub Kicinski]

On Tue, 27 Jan 2026 19:14:59 -0800 Stanislav Fomichev wrote:
> > problem. Ido Schimmel found steps to reproduce
> > 
> >   ip link add name team1 type team
> >   ip link add name dummy1 mtu 1499 master team1 type dummy
> >   ip netns add ns1
> >   ip link set dev dummy1 netns ns1
> >   ip -n ns1 link del dev dummy1  
> 
> Can we add the above as a selftest to
> tools/testing/selftests/net/rtnetlink.sh? I was adding the quirky ones
> (like kci_test_macsec_vlan) over there.. Or maybe something under
> selftests/drivers/net/team/ ?

Under selftests/drivers/net/team/ please, rtnetlink.sh is too much 
of a catch-all.
-- 
pw-bot: cr

Re: [PATCH net v2] team: avoid NETDEV_CHANGEMTU event when unregistering slave

[Tetsuo Handa]

On 2026/01/30 12:12, Jakub Kicinski wrote:
> On Tue, 27 Jan 2026 19:14:59 -0800 Stanislav Fomichev wrote:
>>> problem. Ido Schimmel found steps to reproduce
>>>
>>>   ip link add name team1 type team
>>>   ip link add name dummy1 mtu 1499 master team1 type dummy
>>>   ip netns add ns1
>>>   ip link set dev dummy1 netns ns1
>>>   ip -n ns1 link del dev dummy1  
>>
>> Can we add the above as a selftest to
>> tools/testing/selftests/net/rtnetlink.sh? I was adding the quirky ones
>> (like kci_test_macsec_vlan) over there.. Or maybe something under
>> selftests/drivers/net/team/ ?
> 
> Under selftests/drivers/net/team/ please, rtnetlink.sh is too much 
> of a catch-all.

This patch seems stalling. Who is supposed to create a selftest?

Re: [PATCH net v2] team: avoid NETDEV_CHANGEMTU event when unregistering slave

[Ido Schimmel]

On Sun, Feb 22, 2026 at 04:16:43PM +0900, Tetsuo Handa wrote:
> This patch seems stalling. Who is supposed to create a selftest?

The author of the fix (you).

But don't squash it into the same patch as the fix:
https://docs.kernel.org/process/maintainer-netdev.html#co-posting-selftests

[PATCH] selftests/net: team: add team unregister test

[Tetsuo Handa]

Add selftest for "team: avoid NETDEV_CHANGEMTU event when unregistering
slave" patch.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
---
Does Makefile look OK?

 tools/testing/selftests/net/team/Makefile     |  7 ++++++
 .../selftests/net/team/team_unregister.sh     | 24 +++++++++++++++++++
 2 files changed, 31 insertions(+)
 create mode 100644 tools/testing/selftests/net/team/Makefile
 create mode 100755 tools/testing/selftests/net/team/team_unregister.sh

diff --git a/tools/testing/selftests/net/team/Makefile b/tools/testing/selftests/net/team/Makefile
new file mode 100644
index 000000000000..aa8ef0590022
--- /dev/null
+++ b/tools/testing/selftests/net/team/Makefile
@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: GPL-2.0
+
+top_srcdir = ../../../../..
+
+TEST_PROGS := team_unregister.sh
+
+include ../../lib.mk
diff --git a/tools/testing/selftests/net/team/team_unregister.sh b/tools/testing/selftests/net/team/team_unregister.sh
new file mode 100755
index 000000000000..94dd49b0c21b
--- /dev/null
+++ b/tools/testing/selftests/net/team/team_unregister.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2022 Meta Platforms, Inc. and affiliates.
+
+source ../lib.sh
+
+NS_NAME="ns-"$RANDOM
+TEAM_NAME="team-"$RANDOM
+DUMMY_NAME="dummy-"$RANDOM
+
+cleanup() {
+    cleanup_ns $NS_NAME
+    ip link del $TEAM_NAME
+}
+
+trap cleanup EXIT
+ip link add name $TEAM_NAME type team
+ip link add name $DUMMY_NAME mtu 1499 master $TEAM_NAME type dummy
+ip netns add $NS_NAME
+echo "Setting $DUMMY_NAME to $NS_NAME"
+ip link set dev $DUMMY_NAME netns $NS_NAME
+echo "Deleting $DUMMY_NAME from $NS_NAME"
+ip -n $NS_NAME link del dev $DUMMY_NAME
+echo "Test completed successfully."
-- 
2.53.0

[PATCH v2] selftests/net: team: add team unregister test

[Tetsuo Handa]

Add selftest for "team: avoid NETDEV_CHANGEMTU event when unregistering
slave" patch.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
---
v2:
 - Removed unexpectedly-copied Copyright line.

 tools/testing/selftests/net/team/Makefile     |  7 ++++++
 .../selftests/net/team/team_unregister.sh     | 23 +++++++++++++++++++
 2 files changed, 30 insertions(+)
 create mode 100644 tools/testing/selftests/net/team/Makefile
 create mode 100755 tools/testing/selftests/net/team/team_unregister.sh

diff --git a/tools/testing/selftests/net/team/Makefile b/tools/testing/selftests/net/team/Makefile
new file mode 100644
index 000000000000..aa8ef0590022
--- /dev/null
+++ b/tools/testing/selftests/net/team/Makefile
@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: GPL-2.0
+
+top_srcdir = ../../../../..
+
+TEST_PROGS := team_unregister.sh
+
+include ../../lib.mk
diff --git a/tools/testing/selftests/net/team/team_unregister.sh b/tools/testing/selftests/net/team/team_unregister.sh
new file mode 100755
index 000000000000..cfa710237d8b
--- /dev/null
+++ b/tools/testing/selftests/net/team/team_unregister.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+source ../lib.sh
+
+NS_NAME="ns-"$RANDOM
+TEAM_NAME="team-"$RANDOM
+DUMMY_NAME="dummy-"$RANDOM
+
+cleanup() {
+    cleanup_ns $NS_NAME
+    ip link del $TEAM_NAME
+}
+
+trap cleanup EXIT
+ip link add name $TEAM_NAME type team
+ip link add name $DUMMY_NAME mtu 1499 master $TEAM_NAME type dummy
+ip netns add $NS_NAME
+echo "Setting $DUMMY_NAME to $NS_NAME"
+ip link set dev $DUMMY_NAME netns $NS_NAME
+echo "Deleting $DUMMY_NAME from $NS_NAME"
+ip -n $NS_NAME link del dev $DUMMY_NAME
+echo "Test completed successfully."
-- 
2.53.0

Re: [PATCH v2] selftests/net: team: add team unregister test

[Ido Schimmel]

On Sun, Feb 22, 2026 at 10:17:42PM +0900, Tetsuo Handa wrote:
> Add selftest for "team: avoid NETDEV_CHANGEMTU event when unregistering
> slave" patch.

1. Repost the entire series (fix + selftest).
2. Tag as "[PATCH net vX]".
3. Wait 24h before reposting.
4. Post as a new thread instead of as a reply to an existing thread.

See more info here:

https://docs.kernel.org/process/maintainer-netdev.html

> 
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> ---
> v2:
>  - Removed unexpectedly-copied Copyright line.
> 
>  tools/testing/selftests/net/team/Makefile     |  7 ++++++
>  .../selftests/net/team/team_unregister.sh     | 23 +++++++++++++++++++
>  2 files changed, 30 insertions(+)
>  create mode 100644 tools/testing/selftests/net/team/Makefile
>  create mode 100755 tools/testing/selftests/net/team/team_unregister.sh

The team selftests are under tools/testing/selftests/drivers/net/team/,
so this one should be added there as well

> 
> diff --git a/tools/testing/selftests/net/team/Makefile b/tools/testing/selftests/net/team/Makefile
> new file mode 100644
> index 000000000000..aa8ef0590022
> --- /dev/null
> +++ b/tools/testing/selftests/net/team/Makefile
> @@ -0,0 +1,7 @@
> +# SPDX-License-Identifier: GPL-2.0
> +
> +top_srcdir = ../../../../..
> +
> +TEST_PROGS := team_unregister.sh
> +
> +include ../../lib.mk
> diff --git a/tools/testing/selftests/net/team/team_unregister.sh b/tools/testing/selftests/net/team/team_unregister.sh
> new file mode 100755
> index 000000000000..cfa710237d8b
> --- /dev/null
> +++ b/tools/testing/selftests/net/team/team_unregister.sh
> @@ -0,0 +1,23 @@
> +#!/bin/bash
> +# SPDX-License-Identifier: GPL-2.0
> +
> +source ../lib.sh
> +
> +NS_NAME="ns-"$RANDOM
> +TEAM_NAME="team-"$RANDOM
> +DUMMY_NAME="dummy-"$RANDOM

No need for "$RANDOM" if you use setup_ns() to create namespaces with a
randomized name.

> +
> +cleanup() {
> +    cleanup_ns $NS_NAME

Quote variables to avoid shellcheck warnings

> +    ip link del $TEAM_NAME
> +}
> +
> +trap cleanup EXIT
> +ip link add name $TEAM_NAME type team
> +ip link add name $DUMMY_NAME mtu 1499 master $TEAM_NAME type dummy
> +ip netns add $NS_NAME
> +echo "Setting $DUMMY_NAME to $NS_NAME"
> +ip link set dev $DUMMY_NAME netns $NS_NAME
> +echo "Deleting $DUMMY_NAME from $NS_NAME"
> +ip -n $NS_NAME link del dev $DUMMY_NAME
> +echo "Test completed successfully."

This patch [1] works for me (hangs without the fix):

# make -C tools/testing/selftests TARGETS="drivers/net/team" TEST_PROGS=refleak.sh TEST_GEN_PROGS="" run_tests
make: Entering directory '/home/idosch/code/linux/tools/testing/selftests'
make[1]: Nothing to be done for 'all'.
TAP version 13
1..1
# timeout set to 45
# selftests: drivers/net/team: refleak.sh
ok 1 selftests: drivers/net/team: refleak.sh

[1]
diff --git a/tools/testing/selftests/drivers/net/team/Makefile b/tools/testing/selftests/drivers/net/team/Makefile
index 1340b3df9c31..45a3e7ad3dcb 100644
--- a/tools/testing/selftests/drivers/net/team/Makefile
+++ b/tools/testing/selftests/drivers/net/team/Makefile
@@ -5,6 +5,7 @@ TEST_PROGS := \
 	dev_addr_lists.sh \
 	options.sh \
 	propagation.sh \
+	refleak.sh \
 # end of TEST_PROGS
 
 TEST_INCLUDES := \
diff --git a/tools/testing/selftests/drivers/net/team/refleak.sh b/tools/testing/selftests/drivers/net/team/refleak.sh
new file mode 100755
index 000000000000..53675be04965
--- /dev/null
+++ b/tools/testing/selftests/drivers/net/team/refleak.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+lib_dir=$(dirname "$0")
+source "$lib_dir"/../../../net/lib.sh
+
+trap cleanup_all_ns EXIT
+
+# Test that there is no reference count leak and that dummy1 can be deleted.
+# https://lore.kernel.org/netdev/4d69abe1-ca8d-4f0b-bcf8-13899b211e57@I-love.SAKURA.ne.jp/
+setup_ns ns1 ns2
+ip -n "$ns1" link add name team1 type team
+ip -n "$ns1" link add name dummy1 mtu 1499 type dummy
+ip -n "$ns1" link set dev dummy1 master team1
+ip -n "$ns1" link set dev dummy1 netns "$ns2"
+ip -n "$ns2" link del dev dummy1

Re: [PATCH v2] selftests/net: team: add team unregister test

[Tetsuo Handa]

On 2026/02/23 0:32, Ido Schimmel wrote:
> This patch [1] works for me (hangs without the fix):

OK. Please go with your version. :-)

Re: [PATCH v2] selftests/net: team: add team unregister test

[Ido Schimmel]

On Mon, Feb 23, 2026 at 12:40:33AM +0900, Tetsuo Handa wrote:
> On 2026/02/23 0:32, Ido Schimmel wrote:
> > This patch [1] works for me (hangs without the fix):
> 
> OK. Please go with your version. :-)

I will submit v3 (fix + test) tomorrow