[PATCH net] net: do not bond/team netdevices which use ml_priv

[PATCH net] net: do not bond/team netdevices which use ml_priv

[Oliver Hartkopp]

Commit 8ba68464e478 ("bonding: refuse to enslave CAN devices") already
addressed a syzbot kernel paging request crash report for bonding.
The same problem is also valid for the team device driver as both work on
netdevices without taking care of the private mid-layer data structures.

To reject ARPHRD_CAN, ARPHRD_IEEE802154, and ARPHRD_IEEE802154_MONITOR
netdevices does not solve the root cause of the problem as ml_priv is also
used by some ancient ethernet drivers like S/390 or 82596 based drivers.
Today those ethernet drivers likely would not use ml_priv at all.

Make sure that only capable netdevices are offered to teaming and bonding
by checking that ml_priv is unused.

Fixes: 8ba68464e478 ("bonding: refuse to enslave CAN devices")
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
---
 drivers/net/bonding/bond_main.c | 4 ++--
 drivers/net/team/team_core.c    | 7 +++++++
 include/linux/netdevice.h       | 5 +++++
 3 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 522eab060f9e..bbb344b67458 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1892,13 +1892,13 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
 	const struct net_device_ops *slave_ops = slave_dev->netdev_ops;
 	struct slave *new_slave = NULL, *prev_slave;
 	struct sockaddr_storage ss;
 	int res = 0, i;
 
-	if (slave_dev->type == ARPHRD_CAN) {
+	if (netdev_has_ml_priv(slave_dev)) {
 		BOND_NL_ERR(bond_dev, extack,
-			    "CAN devices cannot be enslaved");
+			    "devices using ml_priv cannot be enslaved");
 		return -EPERM;
 	}
 
 	if (slave_dev->flags & IFF_MASTER &&
 	    !netif_is_bond_master(slave_dev)) {
diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
index feaa75fbf8fc..8bf4c1c5d657 100644
--- a/drivers/net/team/team_core.c
+++ b/drivers/net/team/team_core.c
@@ -1215,10 +1215,17 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
 	struct net_device *dev = netdev_from_priv(team);
 	struct team_port *port;
 	char *portname = port_dev->name;
 	int err;
 
+	if (netdev_has_ml_priv(port_dev)) {
+		NL_SET_ERR_MSG(extack, "devices using ml_priv can't be added as a team port");
+		netdev_err(dev, "Device %s using ml_priv can't be added as a team port\n",
+			   portname);
+		return -EINVAL;
+	}
+
 	if (port_dev->flags & IFF_LOOPBACK) {
 		NL_SET_ERR_MSG(extack, "Loopback device can't be added as a team port");
 		netdev_err(dev, "Device %s is loopback device. Loopback devices can't be added as a team port\n",
 			   portname);
 		return -EINVAL;
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 8840b126979f..74536f642b41 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -2784,10 +2784,15 @@ static inline void netdev_set_ml_priv(struct net_device *dev,
 
 	dev->ml_priv = ml_priv;
 	dev->ml_priv_type = type;
 }
 
+static inline bool netdev_has_ml_priv(struct net_device *dev)
+{
+	return (dev->ml_priv != NULL);
+}
+
 /*
  * Net namespace inlines
  */
 static inline
 struct net *dev_net(const struct net_device *dev)
-- 
2.53.0

Re: [PATCH net] net: do not bond/team netdevices which use ml_priv

[Stephen Hemminger]

On Sat, 15 Aug 2026 17:39:38 +0200
Oliver Hartkopp <socketcan@hartkopp.net> wrote:

> +static inline bool netdev_has_ml_priv(struct net_device *dev)
> +{
> +	return (dev->ml_priv != NULL);
> +}
> +

Minor suggestion: use const and drop unneeded parens

static inline bool netdev_has_ml_priv(const struct net_device *dev)
{
	return dev->ml_priv != NULL;
}

Re: [PATCH net] net: do not bond/team netdevices which use ml_priv

[Oliver Hartkopp]

On 15.08.26 18:00, Stephen Hemminger wrote:
> On Sat, 15 Aug 2026 17:39:38 +0200
> Oliver Hartkopp <socketcan@hartkopp.net> wrote:
> 
>> +static inline bool netdev_has_ml_priv(struct net_device *dev)
>> +{
>> +	return (dev->ml_priv != NULL);
>> +}
>> +
> 
> Minor suggestion: use const and drop unneeded parens
> 
> static inline bool netdev_has_ml_priv(const struct net_device *dev)
> {
> 	return dev->ml_priv != NULL;
> }
> 
> 

Good point!

Will wait for some more feedback before sending a v2.

Many thanks,
Oliver

Re: [PATCH net] net: do not bond/team netdevices which use ml_priv

[Hangbin Liu]

On Sat, Aug 15, 2026 at 07:23:35PM +0200, Oliver Hartkopp wrote:
> 
> 
> On 15.08.26 18:00, Stephen Hemminger wrote:
> > On Sat, 15 Aug 2026 17:39:38 +0200
> > Oliver Hartkopp <socketcan@hartkopp.net> wrote:
> > 
> > > +static inline bool netdev_has_ml_priv(struct net_device *dev)
> > > +{
> > > +	return (dev->ml_priv != NULL);
> > > +}
> > > +
> > 
> > Minor suggestion: use const and drop unneeded parens
> > 
> > static inline bool netdev_has_ml_priv(const struct net_device *dev)
> > {
> > 	return dev->ml_priv != NULL;
> > }
> > 
> > 
> 
> Good point!
> 
> Will wait for some more feedback before sending a v2.

Hi Oliver,

Sashiko gives some feed back[1], would you please check it?

[1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260815153938.187073-1-socketcan%40hartkopp.net

Thanks
Hangbin

Re: [PATCH net] net: do not bond/team netdevices which use ml_priv

[Oliver Hartkopp]

Hi Hangbin,

On 18.08.26 12:12, Hangbin Liu wrote:
> On Sat, Aug 15, 2026 at 07:23:35PM +0200, Oliver Hartkopp wrote:
>>
>>
>> On 15.08.26 18:00, Stephen Hemminger wrote:
>>> On Sat, 15 Aug 2026 17:39:38 +0200
>>> Oliver Hartkopp <socketcan@hartkopp.net> wrote:
>>>
>>>> +static inline bool netdev_has_ml_priv(struct net_device *dev)
>>>> +{
>>>> +	return (dev->ml_priv != NULL);
>>>> +}
>>>> +
>>>
>>> Minor suggestion: use const and drop unneeded parens
>>>
>>> static inline bool netdev_has_ml_priv(const struct net_device *dev)
>>> {
>>> 	return dev->ml_priv != NULL;
>>> }
>>>
>>>
>>
>> Good point!
>>
>> Will wait for some more feedback before sending a v2.
> 
> Hi Oliver,
> 
> Sashiko gives some feed back[1], would you please check it?
> 
> [1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260815153938.187073-1-socketcan%40hartkopp.net
> 

Unfortunately the AI bot review did not create a proper answer, so that 
I would be able to answer in-line.

Sashiko says:

"Is this test too broad for plain Ethernet slaves?
netdev_has_ml_priv() only looks at dev->ml_priv, not at 
dev->ml_priv_type, so it matches any driver that stashes a private 
pointer there, including ARPHRD_ETHER NICs that were never involved in 
the CAN crash."

and later also points out potential problems that could arise with tun.

Today only the CAN subsystem properly sets dev->ml_priv_type. Other 
users simply grab dev->ml_priv for their needs (inkognito).

To me the question is whether bonding/teaming and now also tunneling 
code takes care about the mid-layer private pointer dev->ml_priv?!?

The fact that the issues have been found by syzbot for CAN devices might 
be through to the fact that the virtual CAN interface (vcan) can be 
created by netlink commands and can be easily used in test setups.

So what would happen, if the same tests with bonding/teaming/tunneling 
would be done with real hardware drivers as the mentioned "direct 
ml_priv writers still in tree at this revision:

   drivers/s390/net/qeth_core_main.c:qeth_alloc_netdev()
       dev->ml_priv = card;
   drivers/net/ethernet/chelsio/cxgb/cxgb2.c:init_one()
       netdev->ml_priv = adapter;
   drivers/net/wan/hdlc_fr.c:fr_add_pvc()
       dev->ml_priv = pvc;

plus drivers/net/ethernet/i825xx/82596.c, drivers/s390/net/ctcm_main.c,
the libertas main.c/mesh.c paths and
drivers/net/wireless/microchip/wilc1000/netdev.c."

??

If bonding/teaming/tunneling might accidentally overwrite dev->ml_priv 
we have to block all those devices. No matter if it is CAN or whatever 
ethernet device.

And this it what this patch aims for.

So either the users were lucky so far or they never used 
bonding/teaming/tunneling on these devices? I don't know.

But it definitely looks like we should make a safe move to block all 
ml_priv using devices.

Most of the referenced drivers are 20+ years old! Only 
drivers/net/wireless/microchip/wilc1000/netdev.c is about 11 years old 
and moved from staging into mainline in 2020. The use of ml_priv is a 
left-over from the former out out tree development. The wilc1000 drivers 
does not use the existing infrastructure in the correct way. In all 
cases this wifi driver and all the ancient ethernet drivers should (and 
can) be implemented without using the ml_priv pointer today.

When there are (unlikely) real users of those (ancient) drivers together 
with bonding/teaming/tunneling those drivers should be changed in a way 
that they do not need dev->ml_priv anymore.

For that reason

static inline bool netdev_has_ml_priv(struct net_device *dev)
{
	return dev->ml_priv != NULL;
}

seems to be the safe solution that would point out potential problems 
with those drivers immediately.

Best regards,
Oliver