Commit 77da71283cad for kernel

commit 77da71283cad9446d4160531accfb80ebf3d1cbb
Merge: f975a0955276 58f8ef625e23
Author: Jakub Kicinski <kuba@kernel.org>
Date:   Wed Feb 25 19:17:12 2026 -0800

    Merge branch 'team-fix-reference-count-leak-when-changing-port-netns'

    Ido Schimmel says:

    ====================
    team: Fix reference count leak when changing port netns

    Patch #1 fixes a reference count leak that was reported by syzkaller.
    The leak happens when a net device that is member in a team is changing
    netns. The fix is to align the team driver with the bond driver and have
    it suppress NETDEV_CHANGEMTU events for a net device that is being
    unregistered.

    Without this change, the NETDEV_CHANGEMTU event causes inetdev_event()
    to recreate an inet device for this net device in its original netns,
    after it was previously destroyed upon NETDEV_UNREGISTER. Later on, when
    inetdev_event() receives a NETDEV_REGISTER event for this net device in
    the new nents, it simply leaks the reference:

    case NETDEV_REGISTER:
            pr_debug("%s: bug\n", __func__);
            RCU_INIT_POINTER(dev->ip_ptr, NULL);
            break;

    addrconf_notify() handles this differently and reuses the existing inet6
    device if one exists when a NETDEV_REGISTER event is received. This
    creates a different problem where it is possible for a net device to
    reference an inet6 device that was created in a previous netns.

    A more generic fix that we can try in net-next is to revert the changes
    in the bond and team drivers and instead have IPv4 and IPv6 destroy and
    recreate an inet device if one already exists upon NETDEV_REGISTER.

    Patch #2 adds a selftest that passes with the fix and hangs without it.
    ====================

    Link: https://patch.msgid.link/20260224125709.317574-1-idosch@nvidia.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>