From: Jakub Kicinski Date: Thu, 26 Feb 2026 03:17:12 +0000 (-0800) Subject: Merge branch 'team-fix-reference-count-leak-when-changing-port-netns' X-Git-Tag: v7.0-rc2~36^2~6 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=77da71283cad9446d4160531accfb80ebf3d1cbb;p=thirdparty%2Fkernel%2Flinux.git Merge branch 'team-fix-reference-count-leak-when-changing-port-netns' Ido Schimmel says: ==================== team: Fix reference count leak when changing port netns Patch #1 fixes a reference count leak that was reported by syzkaller. The leak happens when a net device that is member in a team is changing netns. The fix is to align the team driver with the bond driver and have it suppress NETDEV_CHANGEMTU events for a net device that is being unregistered. Without this change, the NETDEV_CHANGEMTU event causes inetdev_event() to recreate an inet device for this net device in its original netns, after it was previously destroyed upon NETDEV_UNREGISTER. Later on, when inetdev_event() receives a NETDEV_REGISTER event for this net device in the new nents, it simply leaks the reference: case NETDEV_REGISTER: pr_debug("%s: bug\n", __func__); RCU_INIT_POINTER(dev->ip_ptr, NULL); break; addrconf_notify() handles this differently and reuses the existing inet6 device if one exists when a NETDEV_REGISTER event is received. This creates a different problem where it is possible for a net device to reference an inet6 device that was created in a previous netns. A more generic fix that we can try in net-next is to revert the changes in the bond and team drivers and instead have IPv4 and IPv6 destroy and recreate an inet device if one already exists upon NETDEV_REGISTER. Patch #2 adds a selftest that passes with the fix and hangs without it. ==================== Link: https://patch.msgid.link/20260224125709.317574-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski --- 77da71283cad9446d4160531accfb80ebf3d1cbb