Re: [PATCH net] bonding: alb: fix uninitialized transport header access in alb_determine_nd()

[Joe Damato <joe@dama.to>]

On Mon, Aug 31, 2026 at 07:46:26PM +0000, Eric Dumazet wrote:
> alb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers.
> However, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets
> or forwarded packets), skb->transport_header is not guaranteed to be
> initialized. While pskb_network_may_pull() ensures the packet data is
> linear starting from the network header, it does not set or adjust the
> transport header offset.
> 
> Dereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory.
> 
> Fetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(),
> and reload ipv6hdr in case pskb_may_pull() reallocated skb->head.
> Also remove the unused bond argument from alb_determine_nd().
> 
> Fixes: 0da8aa00bfcf ("net: bonding: Add support for IPV6 ns/na to balance-alb/balance-tlb mode")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
> Cc: Jay Vosburgh <jv@jvosburgh.net>
> ---
>  drivers/net/bonding/bond_alb.c | 13 +++++++------
>  1 file changed, 7 insertions(+), 6 deletions(-)
> 

Reviewed-by: Joe Damato <joe@dama.to>