Re: [PATCH net v2] net: team: fix NULL pointer dereference in team_xmit during mode change

[Jakub Kicinski <kuba@kernel.org>]

On Mon, 18 May 2026 17:51:54 +0800 Weiming Shi wrote:
> On 26-05-10 09:59, Jakub Kicinski wrote:
> > On Mon, 11 May 2026 00:06:50 +0800 Weiming Shi wrote:  
> > > The handler function pointer against the mode_priv state it operates
> > > on.  On setup, init() writes mode_priv, then smp_store_release()
> > > publishes the real handler - the paired smp_load_acquire() in the
> > > reader ensures the handler sees that state.  On teardown,
> > > smp_store_release() publishes the dummy before synchronize_net()
> > > drains readers, so exit_op() won't tear down state under an
> > > in-flight reader.  
> > 
> > Still does not make sense to me. You already add sync_net().
> > And if it's possible to switch from dummy to non-dummy mode
> > the ordering is inverted.
> >   
> > > Not specific to the bug, just a reproducer detail.  Dropped.
> > > 
> > > Sending v3 with the updated changelog shortly.  
> > 
> > Please don't rush new versions out.  
> 
> Hi Jakub,
> 
> Apologies for the late reply and for rushing v3.
> 
> I was muddling two things. On teardown synchronize_net() is the protection,
> the release/acquire is for the setup path where init() writes
> mode_priv before team_adjust_ops() publishes the handler.
> 
> If that makes sense I'll send v4 with the corrected commit message.

Can you provide more details for the init() path race?
What's the sequence of events?