Re: [PATCH net v2] net: team: fix NULL pointer dereference in team_xmit during mode change

[Weiming Shi <bestswngs@gmail.com>]

On 26-05-18 14:22, Jakub Kicinski wrote:
> On Mon, 18 May 2026 17:51:54 +0800 Weiming Shi wrote:
> > On 26-05-10 09:59, Jakub Kicinski wrote:
> > > On Mon, 11 May 2026 00:06:50 +0800 Weiming Shi wrote:  
> > > > The handler function pointer against the mode_priv state it operates
> > > > on.  On setup, init() writes mode_priv, then smp_store_release()
> > > > publishes the real handler - the paired smp_load_acquire() in the
> > > > reader ensures the handler sees that state.  On teardown,
> > > > smp_store_release() publishes the dummy before synchronize_net()
> > > > drains readers, so exit_op() won't tear down state under an
> > > > in-flight reader.  
> > > 
> > > Still does not make sense to me. You already add sync_net().
> > > And if it's possible to switch from dummy to non-dummy mode
> > > the ordering is inverted.
> > >   
> > > > Not specific to the bug, just a reproducer detail.  Dropped.
> > > > 
> > > > Sending v3 with the updated changelog shortly.  
> > > 
> > > Please don't rush new versions out.  
> > 
> > Hi Jakub,
> > 
> > Apologies for the late reply and for rushing v3.
> > 
> > I was muddling two things. On teardown synchronize_net() is the protection,
> > the release/acquire is for the setup path where init() writes
> > mode_priv before team_adjust_ops() publishes the handler.
> > 
> > If that makes sense I'll send v4 with the corrected commit message.
> 
> Can you provide more details for the init() path race?
> What's the sequence of events?

With loadbalance mode:
 
  lb_init() stores select_tx_port_func (team_mode_loadbalance.c:595).
  When a port is later enabled, team_adjust_ops() publishes
  lb_transmit with a plain store (team_core.c:539).

Without the release/acquire, a concurrent team_xmit() on a weakly-ordered 
arch can see lb_transmit but not the select_tx_port_func store, and lb_transmit 
dereferences it at line 227.

I'll send a PoC in the next mail so you can reproduce it.