[PATCH net] bonding: alb: fix uninitialized transport header access in alb_determine_nd()

[PATCH net] bonding: alb: fix uninitialized transport header access in alb_determine_nd()

[Eric Dumazet]

alb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers.
However, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets
or forwarded packets), skb->transport_header is not guaranteed to be
initialized. While pskb_network_may_pull() ensures the packet data is
linear starting from the network header, it does not set or adjust the
transport header offset.

Dereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory.

Fetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(),
and reload ipv6hdr in case pskb_may_pull() reallocated skb->head.
Also remove the unused bond argument from alb_determine_nd().

Fixes: 0da8aa00bfcf ("net: bonding: Add support for IPV6 ns/na to balance-alb/balance-tlb mode")
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
Cc: Jay Vosburgh <jv@jvosburgh.net>
---
 drivers/net/bonding/bond_alb.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 839f7482dc18..5073aeeba6c9 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -1281,10 +1281,10 @@ static int alb_set_mac_address(struct bonding *bond, void *addr)
 }
 
 /* determine if the packet is NA or NS */
-static bool alb_determine_nd(struct sk_buff *skb, struct bonding *bond)
+static bool alb_determine_nd(struct sk_buff *skb)
 {
-	struct ipv6hdr *ip6hdr;
-	struct icmp6hdr *hdr;
+	const struct ipv6hdr *ip6hdr;
+	const struct icmp6hdr *hdr;
 
 	if (!pskb_network_may_pull(skb, sizeof(*ip6hdr)))
 		return true;
@@ -1296,7 +1296,8 @@ static bool alb_determine_nd(struct sk_buff *skb, struct bonding *bond)
 	if (!pskb_network_may_pull(skb, sizeof(*ip6hdr) + sizeof(*hdr)))
 		return true;
 
-	hdr = icmp6_hdr(skb);
+	ip6hdr = ipv6_hdr(skb);
+	hdr = (const struct icmp6hdr *)(ip6hdr + 1);
 	return hdr->icmp6_type == NDISC_NEIGHBOUR_ADVERTISEMENT ||
 		hdr->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION;
 }
@@ -1381,7 +1382,7 @@ struct slave *bond_xmit_tlb_slave_get(struct bonding *bond,
 	if (!is_multicast_ether_addr(eth_data->h_dest)) {
 		switch (skb->protocol) {
 		case htons(ETH_P_IPV6):
-			if (alb_determine_nd(skb, bond))
+			if (alb_determine_nd(skb))
 				break;
 			fallthrough;
 		case htons(ETH_P_IP):
@@ -1467,7 +1468,7 @@ struct slave *bond_xmit_alb_slave_get(struct bonding *bond,
 			break;
 		}
 
-		if (alb_determine_nd(skb, bond)) {
+		if (alb_determine_nd(skb)) {
 			do_tx_balance = false;
 			break;
 		}
-- 
2.55.0.970.g62bdec98f9-goog

Re: [PATCH net] bonding: alb: fix uninitialized transport header access in alb_determine_nd()

[Joe Damato]

On Mon, Aug 31, 2026 at 07:46:26PM +0000, Eric Dumazet wrote:
> alb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers.
> However, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets
> or forwarded packets), skb->transport_header is not guaranteed to be
> initialized. While pskb_network_may_pull() ensures the packet data is
> linear starting from the network header, it does not set or adjust the
> transport header offset.
> 
> Dereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory.
> 
> Fetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(),
> and reload ipv6hdr in case pskb_may_pull() reallocated skb->head.
> Also remove the unused bond argument from alb_determine_nd().
> 
> Fixes: 0da8aa00bfcf ("net: bonding: Add support for IPV6 ns/na to balance-alb/balance-tlb mode")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
> Cc: Jay Vosburgh <jv@jvosburgh.net>
> ---
>  drivers/net/bonding/bond_alb.c | 13 +++++++------
>  1 file changed, 7 insertions(+), 6 deletions(-)
> 

Reviewed-by: Joe Damato <joe@dama.to>

Re: [PATCH net] bonding: alb: fix uninitialized transport header access in alb_determine_nd()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon, 31 Aug 2026 19:46:26 +0000 you wrote:
> alb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers.
> However, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets
> or forwarded packets), skb->transport_header is not guaranteed to be
> initialized. While pskb_network_may_pull() ensures the packet data is
> linear starting from the network header, it does not set or adjust the
> transport header offset.
> 
> [...]

Here is the summary with links:
  - [net] bonding: alb: fix uninitialized transport header access in alb_determine_nd()
    https://git.kernel.org/netdev/net/c/70f3995830d3

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html