Re: [PATCH net v4] net: team: fix NULL pointer dereference in team_xmit during mode change

[Jiayuan Chen <jiayuan.chen@linux.dev>]

On 5/21/26 4:12 PM, Weiming Shi wrote:
> __team_change_mode() clears team->ops with memset() before restoring
> safe dummy handlers via team_adjust_ops(). A concurrent team_xmit()
> running under RCU on another CPU can read team->ops.transmit during
> this window and call a NULL function pointer, crashing the kernel.
>
> The race requires a mode change (CAP_NET_ADMIN) concurrent with
> transmit on the team device.
>
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   Oops: 0010 [#1] SMP KASAN NOPTI
>   RIP: 0010:0x0
>   Call Trace:
>    team_xmit (drivers/net/team/team_core.c:1853)
>    dev_hard_start_xmit (net/core/dev.c:3904)
>    __dev_queue_xmit (net/core/dev.c:4871)
>    packet_sendmsg (net/packet/af_packet.c:3109)
>    __sys_sendto (net/socket.c:2265)
>
> The original code assumed that no ports means no traffic, so mode
> changes could freely memset()/memcpy() the ops.  AF_PACKET with
> forced carrier breaks that assumption.
>
> Prevent the race instead of making it safe: replace memset()/memcpy()
> with per-field updates that never touch transmit or receive.  Those
> two handlers are managed solely by team_adjust_ops(), which already
> installs dummies when tx_en_port_count == 0 (always true during mode
> change since no ports are present).  WRITE_ONCE/READ_ONCE prevent
> store/load tearing on the handler pointers.
>
> synchronize_net() before exit_op() drains in-flight readers that may
> still reference old mode state from before port removal switched the
> handlers to dummies.
>
> Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device")
> Reported-by: Xiang Mei <xmei5@asu.edu>
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>


Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>