Re: [PATCH] team: fix promisc/allmulti leak in team_port_add error path

[Hangbin Liu]

Hi Rongqing,
On Mon, Oct 19, 2026 at 04:31:22PM +0800, lirongqing wrote:
> From: Li RongQing <lirongqing@xxxxxxxxx>
> 
> team_port_add() increments the port's promiscuity and allmulti
> counts before calling team_dev_type_check_change(). If the latter
> fails, the error path does not undo these increments, leaving the
> port in promiscuous and allmulti mode even though it was not
> successfully added to the team.
> 
> Undo both increments in err_set_dev_type, matching the cleanup
> performed by team_port_del().
> 
> Fixes: 43c2adb9df7d ("team: set slave to promisc if team is already in promisc mode")
> Signed-off-by: Li RongQing <lirongqing@xxxxxxxxx>
> ---
>  drivers/net/team/team_core.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
> index ca75f08..3b30063 100644
> --- a/drivers/net/team/team_core.c
> +++ b/drivers/net/team/team_core.c
> @@ -1386,6 +1386,10 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
>  	return 0;
>  
>  err_set_dev_type:
> +	if (dev->flags & IFF_PROMISC)
> +		dev_set_promiscuity(port_dev, -1);
> +	if (dev->flags & IFF_ALLMULTI)
> +		dev_set_allmulti(port_dev, -1);
>  err_set_slave_allmulti:

I think we can remove the dev_set_promiscuity(port_dev, -1); in
if (dev->flags & IFF_ALLMULTI) and move it under here.


Thanks
Hangbin