[PATCH net v2 0/2] net: team: fix transmit skb ownership

[Weiming Shi]

The queue override path can pass an skb to a lower device, see that
dev_queue_xmit() returned a drop, and then reuse the consumed skb. Fix
the handoff decision separately from the transmit result.

An AI-generated review of v1 forwarded by Jakub identified a separate
broadcast-mode leak: bc_transmit() returns without consuming the skb
when no port is txable. Fix that in the second patch.

v1: https://lore.kernel.org/r/20260926090039.1714460-1-bestswngs@xxxxxxxxx

Changes since v1:
- Use list_first_or_null_rcu() in the queue override helper, as Hangbin
  suggested, since only one override port can receive the skb.
- Add a separate broadcast-mode fix for the no-port skb leak raised in
  the AI-generated review forwarded by Jakub.

Weiming Shi (2):
  net: team: stop reusing skb after queue override
  net: team: free skb when broadcast has no txable port

 drivers/net/team/team_core.c           | 16 ++++++++--------
 drivers/net/team/team_mode_broadcast.c |  2 ++
 2 files changed, 10 insertions(+), 8 deletions(-)

-- 
2.55.0