Re: [PATCH net] net/mlx5: Fix slab-out-of-bounds when handling team device events

[Shay Drori <shayd@nvidia.com>]

On 22/09/2026 16:51, Anirudh Virdi wrote:
> External email: Use caution opening links or attachments
> 
> 
> The mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event()
> functions assume the upper device is a bonding device and call bonding-
> specific
> APIs like bond_slave_get_rcu() and bond_is_slave_inactive().
> 
> When a device is enslaved to a team master instead of bonding, the code
> attempts to access the team_port structure as if it were a bond slave
> structure. Since team_port is smaller than slave, this causes KASAN to
> detect an out-of-bounds memory access.
> 
> Fix this by checking explicitly for bonding devices using
> netif_is_bond_master() instead of the generic netif_is_lag_master() which
> includes both bonding and team devices. This ensures mlx5 only processes
> bonding events, not team events, preventing the invalid memory access.
> 
> Tested with Mellanox ConnectX-5 on Linux 7.2.0-rc6:
> - Bonding: PASS (no regressions)
> - Team device: PASS (no KASAN errors)
> 
> Fixes: 54493a08e21f ("net/mlx5: Lag, record inactive state of bond device")
> Signed-off-by: Anirudh Virdi <avirdi@redhat.com>

Reviewed-by: Shay Drory <shayd@nvidia.com>

> ---
>   drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
> index 28d16fdc3f06..022a69cdebaf 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
> @@ -1897,7 +1897,7 @@ static int mlx5_handle_changeupper_event(struct mlx5_lag *ldev,
>          int changed = 0;
>          int i, idx = -1;
> 
> -       if (!netif_is_lag_master(upper))
> +       if (!netif_is_bond_master(upper))
>                  return 0;
> 
>          if (info->linking)
> @@ -2004,7 +2004,7 @@ static int mlx5_handle_changeinfodata_event(struct mlx5_lag *ldev,
>          bool has_inactive = 0;
>          int idx;
> 
> -       if (!netif_is_lag_master(ndev))
> +       if (!netif_is_bond_master(ndev))
>                  return 0;
> 
>          rcu_read_lock();
> --
> 2.55.0
>