[PATCH] team: fix qom_list corruption by using list_del_init_rcu()

[PATCH] team: fix qom_list corruption by using list_del_init_rcu()

[Dharanitharan R]

Reported-by: syzbot+422806e5f4cce722a71f@syzkaller.appspotmail.com
Signed-off-by: Dharanitharan R <dharanitharan725@gmail.com>
---
 drivers/net/team/team_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
index 4d5c9ae8f221..d6d724b52dbf 100644
--- a/drivers/net/team/team_core.c
+++ b/drivers/net/team/team_core.c
@@ -823,7 +823,8 @@ static void __team_queue_override_port_del(struct team *team,
 {
 	if (!port->queue_id)
 		return;
-	list_del_rcu(&port->qom_list);
+	/* Ensure safe repeated deletion */
+	list_del_init_rcu(&port->qom_list);
 }
 
 static bool team_queue_override_port_has_gt_prio_than(struct team_port *port,
-- 
2.43.0

Re: [PATCH] team: fix qom_list corruption by using list_del_init_rcu()

[Simon Horman]

On Sun, Dec 07, 2025 at 02:58:08AM +0000, Dharanitharan R wrote:
> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> 
> Reported-by: syzbot+422806e5f4cce722a71f@syzkaller.appspotmail.com
> Signed-off-by: Dharanitharan R <dharanitharan725@gmail.com>

Hi Dharanitharan,

Please slow down!

It is not appropriate to send multiple versions of a patch CCed to
netdev within in quick succession. Rather, 24h should elapse between
versions. And moreover, I'd advise against CCing netdev on patches
targeted at syzbot testing.

When you do post a fix, for a problem flagged by syzbot, to netdev please
include:

* A description of the problem, and
* How the approach taken fixes it

Typically such a patch will be a bug fix for code present in the net tree.
So it should be targeted at the net tree like this:

Subject: [PATCH net] ...

And it should probably include the following tags:

Fixes:
Reported-by:
Closes:

Especially the Fixes tag.

For an example please see:

https://lore.kernel.org/netdev/20251122002027.695151-1-zlatistiv@gmail.com/

For more information on the Netdev development process please see:

https://docs.kernel.org/process/maintainer-netdev.html

Thanks.

-- 
pw-bot: changes-requested

Re: [PATCH] team: fix qom_list corruption by using list_del_init_rcu()

[syzbot]

> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

This crash does not have a reproducer. I cannot test it.

>
> Reported-by: syzbot+422806e5f4cce722a71f@syzkaller.appspotmail.com
> Signed-off-by: Dharanitharan R <dharanitharan725@gmail.com>
> ---
>  drivers/net/team/team_core.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
> index 4d5c9ae8f221..d6d724b52dbf 100644
> --- a/drivers/net/team/team_core.c
> +++ b/drivers/net/team/team_core.c
> @@ -823,7 +823,8 @@ static void __team_queue_override_port_del(struct team *team,
>  {
>  	if (!port->queue_id)
>  		return;
> -	list_del_rcu(&port->qom_list);
> +	/* Ensure safe repeated deletion */
> +	list_del_init_rcu(&port->qom_list);
>  }
>  
>  static bool team_queue_override_port_has_gt_prio_than(struct team_port *port,
> -- 
> 2.43.0
>

[PATCH] team: fix qom_list corruption by using list_del_init_rcu()

[Dharanitharan R]

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

Reported-by: syzbot+422806e5f4cce722a71f@syzkaller.appspotmail.com
Signed-off-by: Dharanitharan R <dharanitharan725@gmail.com>
---
 drivers/net/team/team_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
index 4d5c9ae8f221..d6d724b52dbf 100644
--- a/drivers/net/team/team_core.c
+++ b/drivers/net/team/team_core.c
@@ -823,7 +823,8 @@ static void __team_queue_override_port_del(struct team *team,
 {
 	if (!port->queue_id)
 		return;
-	list_del_rcu(&port->qom_list);
+	/* Ensure safe repeated deletion */
+	list_del_init_rcu(&port->qom_list);
 }
 
 static bool team_queue_override_port_has_gt_prio_than(struct team_port *port,
-- 
2.43.0