[PATCH net] net/mlx5: Fix slab-out-of-bounds when handling team device events

[Anirudh Virdi <avirdi@redhat.com>]

The mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event()
functions assume the upper device is a bonding device and call bonding-
specific
APIs like bond_slave_get_rcu() and bond_is_slave_inactive().

When a device is enslaved to a team master instead of bonding, the code
attempts to access the team_port structure as if it were a bond slave
structure. Since team_port is smaller than slave, this causes KASAN to
detect an out-of-bounds memory access.

Fix this by checking explicitly for bonding devices using
netif_is_bond_master() instead of the generic netif_is_lag_master() which
includes both bonding and team devices. This ensures mlx5 only processes
bonding events, not team events, preventing the invalid memory access.

Tested with Mellanox ConnectX-5 on Linux 7.2.0-rc6:
- Bonding: PASS (no regressions)
- Team device: PASS (no KASAN errors)

Fixes: 54493a08e21f ("net/mlx5: Lag, record inactive state of bond device")
Signed-off-by: Anirudh Virdi <avirdi@redhat.com>
---
 drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
index 28d16fdc3f06..022a69cdebaf 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
@@ -1897,7 +1897,7 @@ static int mlx5_handle_changeupper_event(struct mlx5_lag *ldev,
 	int changed = 0;
 	int i, idx = -1;
 
-	if (!netif_is_lag_master(upper))
+	if (!netif_is_bond_master(upper))
 		return 0;
 
 	if (info->linking)
@@ -2004,7 +2004,7 @@ static int mlx5_handle_changeinfodata_event(struct mlx5_lag *ldev,
 	bool has_inactive = 0;
 	int idx;
 
-	if (!netif_is_lag_master(ndev))
+	if (!netif_is_bond_master(ndev))
 		return 0;
 
 	rcu_read_lock();
-- 
2.55.0