Subject: Re: [PATCH net v2] net: team: fix NULL pointer dereference in team_xmit during mode change

From: Jakub Kicinski <[email-masked]>
Date: Sun, 10 May 2026 09:59:37 -0700

On Mon, 11 May 2026 00:06:50 +0800 Weiming Shi wrote:
> > Barriers are between things. What are the release / acquire barriers
> > synchronizing.  
> 
> The handler function pointer against the mode_priv state it operates
> on.  On setup, init() writes mode_priv, then smp_store_release()
> publishes the real handler - the paired smp_load_acquire() in the
> reader ensures the handler sees that state.  On teardown,
> smp_store_release() publishes the dummy before synchronize_net()
> drains readers, so exit_op() won't tear down state under an
> in-flight reader.

Still does not make sense to me. You already add sync_net().
And if it's possible to switch from dummy to non-dummy mode
the ordering is inverted.

> > Why is AF_PACKET relevant here??
> >   
> 
> Not specific to the bug, just a reproducer detail.  Dropped.
> 
> Sending v3 with the updated changelog shortly.

Please don't rush new versions out.