]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
bonding: prevent potential infinite loop in bond_header_parse()
authorEric Dumazet <edumazet@google.com>
Sun, 15 Mar 2026 10:41:52 +0000 (10:41 +0000)
committerJakub Kicinski <kuba@kernel.org>
Tue, 17 Mar 2026 02:29:45 +0000 (19:29 -0700)
commitb7405dcf7385445e10821777143f18c3ce20fa04
tree3eb6579409018c3cd699b6c521201a4e6dfb5d7d
parent43d222fbcdff9a715dbe63a0c9e5902f1c9ddd10
bonding: prevent potential infinite loop in bond_header_parse()

bond_header_parse() can loop if a stack of two bonding devices is setup,
because skb->dev always points to the hierarchy top.

Add new "const struct net_device *dev" parameter to
(struct header_ops)->parse() method to make sure the recursion
is bounded, and that the final leaf parse method is called.

Fixes: 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Tested-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Cc: Jay Vosburgh <jv@jvosburgh.net>
Cc: Andrew Lunn <andrew+netdev@lunn.ch>
Link: https://patch.msgid.link/20260315104152.1436867-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/firewire/net.c
drivers/net/bonding/bond_main.c
include/linux/etherdevice.h
include/linux/if_ether.h
include/linux/netdevice.h
net/ethernet/eth.c
net/ipv4/ip_gre.c
net/mac802154/iface.c
net/phonet/af_phonet.c