Re: [PATCH] bonding: reject IEEE 802.15.4 and 6LoWPAN devices in bond_enslave

[Hangbin Liu <hangbin.liu@linux.dev>]

On Thu, Nov 12, 2026 at 06:38:33PM +0530, Kalpesh Solanki wrote:
> When the first non-Ethernet slave is enslaved to a bond,
> bond_setup_by_slave() copies slave_dev->type to the bond device.
> However, the bonding driver does not set up subsystem-specific
> mid-layer contexts or private structures:
> 
> 1. IEEE 802.15.4 routines (such as ieee802154_llsec_dump_table(),
>    nl-phy.c, and socket callbacks) identify WPAN devices by dev->type
>    alone and unconditionally dereference dev->ieee802154_ptr and
>    dev->ml_priv (ieee802154_mlme_ops). Because bonding never allocates
>    these, this results in a NULL pointer dereference.
> 
> 2. The 6LoWPAN netdevice notifier (lowpan_event()) identifies devices
>    by dev->type == ARPHRD_6LOWPAN and treats netdev_priv(dev) as
>    struct lowpan_dev. On a bond master, netdev_priv() is struct bonding,
>    so writes to lowpan_dev(dev)->ctx.table flags on events like
>    NETDEV_DOWN corrupt the bonding driver's private state.
> 
> The team driver closed an identical gap in commit 9043be310c6a ("team:
> reject CAN, IEEE 802.15.4 and 6LoWPAN devices in team_port_add"). Bonding
> previously only blocked CAN devices in commit 8ba68464e478 ("bonding:
> refuse to enslave CAN devices").
> 
> Reject ARPHRD_IEEE802154, ARPHRD_IEEE802154_MONITOR, and ARPHRD_6LOWPAN
> devices in bond_enslave().
> 
> Fixes: 8ba68464e478 ("bonding: refuse to enslave CAN devices")

Nit: I’m a bit wondering whether we should use this fix tag.
The issue exists both before and after this commit.

On the positive side, the tag can notify users to backport this
patch if they also carry 8ba68464e478.

Since this is not a regression, it should probably target net-next.

> Signed-off-by: Kalpesh Solanki <skalpesh942@gmail.com>
> ---
>  drivers/net/bonding/bond_main.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
> index 7019e5d8fdc..b3b003e39b2 100644
> --- a/drivers/net/bonding/bond_main.c
> +++ b/drivers/net/bonding/bond_main.c
> @@ -1894,9 +1894,12 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
>  	struct sockaddr_storage ss;
>  	int res = 0, i;
>  
> -	if (slave_dev->type == ARPHRD_CAN) {
> +	if (slave_dev->type == ARPHRD_CAN ||
> +	    slave_dev->type == ARPHRD_IEEE802154 ||
> +	    slave_dev->type == ARPHRD_IEEE802154_MONITOR ||
> +	    slave_dev->type == ARPHRD_6LOWPAN) {
>  		BOND_NL_ERR(bond_dev, extack,
> -			    "CAN devices cannot be enslaved");
> +			    "CAN, IEEE 802.15.4 and 6LoWPAN devices cannot be enslaved");
>  		return -EPERM;
>  	}
>  
> -- 
> 2.53.0
> 

Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>