From: Paolo Abeni Date: Tue, 14 Apr 2026 08:39:26 +0000 (+0200) Subject: Merge branch 'net-bpf-fix-null-ptr-deref-in-xdp_master_redirect-for-bonding-and-add... X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ab4b6e4e80a0e573bd77d69439e4cb55e9e3c5ee;p=thirdparty%2Fkernel%2Flinux.git Merge branch 'net-bpf-fix-null-ptr-deref-in-xdp_master_redirect-for-bonding-and-add-selftest' Jiayuan Chen says: ==================== net,bpf: fix null-ptr-deref in xdp_master_redirect() for bonding and add selftest From: Jiayuan Chen This series has gone through several rounds of discussion and the maintainers hold different views on where the fix should live (in the generic xdp_master_redirect() path vs. inside bonding). I respect all of the suggestions, but I would like to get the crash fixed first, so this version takes the approach of checking whether the master device is up in xdp_master_redirect(), as suggested by Daniel Borkmann. If a different shape is preferred later it can be done as a follow-up, but the null-ptr-deref should not linger. syzkaller reported a kernel panic, full decoded trace here: https://syzkaller.appspot.com/bug?extid=80e046b8da2820b6ba73 Problem Description bond_rr_gen_slave_id() dereferences bond->rr_tx_counter without a NULL check. rr_tx_counter is a per-CPU counter that bonding only allocates in bond_open() when the mode is round-robin. If the bond device was never brought up, rr_tx_counter stays NULL. The XDP redirect path can still reach that code on a bond that was never opened: bpf_master_redirect_enabled_key is a global static key, so as soon as any bond device has native XDP attached, the XDP_TX -> xdp_master_redirect() interception is enabled for every slave system-wide. The path xdp_master_redirect() -> bond_xdp_get_xmit_slave() -> bond_xdp_xmit_roundrobin_slave_get() -> bond_rr_gen_slave_id() then runs against a bond that has no rr_tx_counter and crashes. Solution Patch 1: Fix this in the generic xdp_master_redirect() by skipping master interception when the master device is not running. Returning XDP_TX keeps the original XDP_TX behaviour on the receiving slave, and avoids calling into any master ->ndo_xdp_get_xmit_slave() on a device that has not fully initialized its XDP state. This is not specific to bonding: any current or future master that defers XDP state allocation to ->ndo_open() is protected. Patch 2: Add a selftest that reproduces the above scenario. v6: https://lore.kernel.org/netdev/20260410113726.368111-1-jiayuan.chen@linux.dev/T/#t v5: https://lore.kernel.org/netdev/20260309030659.xxxxx-1-jiayuan.chen@linux.dev/ v4: https://lore.kernel.org/netdev/20260304074301.35482-1-jiayuan.chen@linux.dev/ v3: https://lore.kernel.org/netdev/20260228021918.141002-1-jiayuan.chen@linux.dev/T/#t v2: https://lore.kernel.org/netdev/20260227092254.272603-1-jiayuan.chen@linux.dev/T/#t v1: https://lore.kernel.org/netdev/20260224112545.37888-1-jiayuan.chen@linux.dev/T/#t [1] https://syzkaller.appspot.com/bug?extid=80e046b8da2820b6ba73 ==================== Link: https://patch.msgid.link/20260411005524.201200-1-jiayuan.chen@linux.dev Signed-off-by: Paolo Abeni --- ab4b6e4e80a0e573bd77d69439e4cb55e9e3c5ee