Patchwork [3.5.y.z,extended,stable] Patch "team: check return value of team_get_port_by_index_rcu() for" has been added to staging queue

mail settings
Submitter Luis Henriques
Date June 24, 2013, 8:19 a.m.
Message ID <>
Download mbox | patch
Permalink /patch/253723/
State New
Headers show


Luis Henriques - June 24, 2013, 8:19 a.m.
This is a note to let you know that I have just added a patch titled

    team: check return value of team_get_port_by_index_rcu() for

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



From faff2470306e69fc07dd342ee52ca46473c295c8 Mon Sep 17 00:00:00 2001
From: Jiri Pirko <>
Date: Sat, 8 Jun 2013 15:00:53 +0200
Subject: [PATCH] team: check return value of team_get_port_by_index_rcu() for

commit 76c455decbbad31de21c727edb184a963f42b40b upstream.

team_get_port_by_index_rcu() might return NULL due to race between port
removal and skb tx path. Panic is easily triggeable when txing packets
and adding/removing port in a loop.

introduced by commit 3d249d4ca "net: introduce ethernet teaming device"
and commit 753f993911b "team: introduce random mode" (for random mode)

Signed-off-by: Jiri Pirko <>
Signed-off-by: David S. Miller <>
[ luis: backported to 3.5: used davem's backport to 3.4:
  - adjusted context
  - dropped changes to team_mode_random.c ]
Signed-off-by: Luis Henriques <>
 drivers/net/team/team_mode_roundrobin.c | 2 ++
 1 file changed, 2 insertions(+)



diff --git a/drivers/net/team/team_mode_roundrobin.c b/drivers/net/team/team_mode_roundrobin.c
index 6abfbdc..d9a5e45 100644
--- a/drivers/net/team/team_mode_roundrobin.c
+++ b/drivers/net/team/team_mode_roundrobin.c
@@ -52,6 +52,8 @@  static bool rr_transmit(struct team *team, struct sk_buff *skb)

 	port_index = rr_priv(team)->sent_packets++ % team->en_port_count;
 	port = team_get_port_by_index_rcu(team, port_index);
+	if (unlikely(!port))
+		goto drop;
 	port = __get_first_port_up(team, port);
 	if (unlikely(!port))
 		goto drop;