]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
selftests: bonding: add test for stacked bond header_parse recursion
authorJiayuan Chen <jiayuan.chen@shopee.com>
Fri, 20 Mar 2026 02:22:39 +0000 (10:22 +0800)
committerJakub Kicinski <kuba@kernel.org>
Tue, 24 Mar 2026 02:37:04 +0000 (19:37 -0700)
commite81cf512c1bdee07fce4a39854dde78cc2cd7b43
treeb8ab849435d57b5df3d068c4c33db1dc4feace1c
parentdb3bd9e55c3c7b159dbd90772ee39441a3133d16
selftests: bonding: add test for stacked bond header_parse recursion

Add a selftest to reproduce the infinite recursion in bond_header_parse()
when bonds are stacked (bond1 -> bond0 -> gre). When a packet is received
via AF_PACKET SOCK_DGRAM on the topmost bond, dev_parse_header() calls
bond_header_parse() which used skb->dev (always the topmost bond) to get
the bonding struct. This caused it to recurse back into itself
indefinitely, leading to stack overflow.

Before commit b7405dcf7385 ("bonding: prevent potential infinite loop
in bond_header_parse()"), the test triggers:

  ./bond_stacked_header_parse.sh

  [  71.999481] BUG: MAX_LOCK_DEPTH too low!
  [  72.000170] turning off the locking correctness validator.
  [  72.001029] Please attach the output of /proc/lock_stat to the bug report
  [  72.002079] depth: 48  max: 48!
  ...

After the fix, everything works fine:

  ./bond_stacked_header_parse.sh
  TEST: Stacked bond header_parse does not recurse                  [ OK ]

Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Link: https://patch.msgid.link/20260320022245.392384-1-jiayuan.chen@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
tools/testing/selftests/drivers/net/bonding/Makefile
tools/testing/selftests/drivers/net/bonding/bond_stacked_header_parse.sh [new file with mode: 0755]
tools/testing/selftests/drivers/net/bonding/config