The queue override path can pass an skb to a lower device, see that
dev_queue_xmit() returned a drop, and then reuse the consumed skb. Fix
the handoff decision separately from the transmit result.
An AI-generated review of v1 forwarded by Jakub identified a separate
broadcast-mode leak: bc_transmit() returns without consuming the skb
when no port is txable. Fix that in the second patch.
v1: https://lore.kernel.org/r/20260926090039.1714460-1-bestswngs@gmail.com (local)
Changes since v1:
- Use list_first_or_null_rcu() in the queue override helper, as Hangbin
suggested, since only one override port can receive the skb.
- Add a separate broadcast-mode fix for the no-port skb leak raised in
the AI-generated review forwarded by Jakub.
Weiming Shi (2):
net: team: stop reusing skb after queue override
net: team: free skb when broadcast has no txable port
drivers/net/team/team_core.c | 16 ++++++++--------
drivers/net/team/team_mode_broadcast.c | 2 ++
2 files changed, 10 insertions(+), 8 deletions(-)
--
2.55.0