Subject: Re: [PATCH net] net: team: fix NULL pointer dereference in team_xmit during mode change

From: Jakub Kicinski <[email-masked]>
Date: Fri, 8 May 2026 18:13:46 -0700

On Wed,  6 May 2026 03:11:08 -0700 Weiming Shi wrote:
> __team_change_mode() clears team->ops with memset() before restoring
> safe dummy handlers via team_adjust_ops().

Can we make it not do that? Perhaps split the memset() into two and
write team_dummy_transmit to transmit? We usually try to move the
complexity from the fast path to configuration paths.

> A concurrent team_xmit()
> running under RCU on another CPU can read team->ops.transmit during
> this window and call a NULL function pointer, crashing the kernel.
-- 
pw-bot: cr