From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f172.google.com (mail-pf1-f172.google.com [209.85.210.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9FA622C0F91 for ; Fri, 6 Mar 2026 02:31:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772764303; cv=none; b=qnbV7WXJC3K7e+5dl3U/JimXdKujUPlVmsxzrsAoz2XVLszy7V1/JzbPonVJVJxK4W87fDMctBA0kUOoW+GnFZw6EqjLP/IXGerAsqRgQu/tOKbAsTF2Yn50yyAk4+QDHDw6HdJKl18rIR5I0TYjxg9YYetZIrduhwDflcPNsh8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772764303; c=relaxed/simple; bh=fW8gBQOtfNePRqpqKBV9lUkeaR7UovNSaxmofrlbQgY=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=n7eV0yXdGtrOgb4JDRkIufJ1e6eeWQp1TQa6nj4bGFXYcqpC4LpgHc2LG4qkB2txRLpeDweFou57d78X10xM3hyl4NkGRFZHpnMHOS7tg9fzdahz8qCIDQ3NwEVTx8HvLKBPJM3URcb1m3AR1oIjpmtMTWBD3H/xbf7Ni6Nk9UA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=hrnUNuw7; arc=none smtp.client-ip=209.85.210.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="hrnUNuw7" Received: by mail-pf1-f172.google.com with SMTP id d2e1a72fcca58-8297c035d28so783266b3a.0 for ; Thu, 05 Mar 2026 18:31:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1772764301; x=1773369101; darn=vger.kernel.org; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:message-id:subject:cc:to:from:date:from:to :cc:subject:date:message-id:reply-to; bh=rrMFSfOaZamk6DLKrZZgW30i49gOAC5qJ6C+E3QqCSQ=; b=hrnUNuw7YMi/37kiHJoeQ3u2A8CKpWbZjeUD1CFNoS8QL/hfK0l+6z48+1umm5sUuq Lzn6EuJ5udHmNEnrDAanCRuN4AbIH/lvtC1GgLPvlJS5F9Xt2bMcO32Tt0+wQ+cGPFSH AtCwImgLiY9Sad2QbefPPtwlw+CtqyWRIyjDxz+a0AIDXoUayT2/d6zijKxdBjBVsOgs l7+xUcKi/NmqTlmdz/ZIZUlWTELQ+gFR1/bmkXR8FM45A37ssig3DPMMNQ8ksU8ZK2GN rf59hQJ81Jec5zPWFXwvgmA/eGDZENEokH8ZaAhb182CijODTD7ZOcC1UyQeeEPcIsBu y1Xg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772764301; x=1773369101; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=rrMFSfOaZamk6DLKrZZgW30i49gOAC5qJ6C+E3QqCSQ=; b=bv0qs7z1dE9IQaXz7FbkRDC0R9p5t/I1XYlypnzj+h8mGq2okH8cdSL2PDZD9sMM+e iVG6NgRjEGWeQgUfKvfsZMpASa+0cJnT4gYyHUTHz+/6O/JhfHTst93MWVjQucl1KrPD XjUederC29iRAbS1Sc+7QxCf/uzqXDGKS59AQMR8U76omxyTmgiMic8WEfNIteaX1LOv pGhws2K0Qi9IVZB9asUwF2QGbz5p6exU6pffZfZN9caYFGi0FSZiIBH72WPuLGxA6ony PBBOH/dad0KTNHnSz+k0MZzeLvxJBQhKsn2rc2/hpDDYO+Zz9HhIm69g/VVnUV4i/tTA CcOg== X-Forwarded-Encrypted: i=1; AJvYcCV6uE0NHKqZiJP5m6PiOat1QDjNOCI7uzqQe0vBPGCBOHp6vQK+RkqBRdbif80ln+ndPjI56PRqVAq+VgY=@vger.kernel.org X-Gm-Message-State: AOJu0Yy+IV/ZmBLSXcm0nOmJv7u5Dj4p+TJ52abja+TmLqc5yWKw+I8D Y/JeAJYsrnLFxf/5aH56V/z+xuyz1VSz8rtdQQB/xxhREWoyrsHceRRy X-Gm-Gg: ATEYQzw9fEgUK+pDHK/ESxilc41AbYpxU6JHoh//iR0OJRddG0Z7JyMn4QMIhMV0TGx IrxgHFTSpTtmAcgUdIWdRVgcTNMUXATPhLPLhWXI65omNWEalMFZFs4D9SEgPSSlnnpnEOmfwFu Cgv91UbmI4JIaRyphl5BJ3tmdkk6Hw12cU6+dlcENFjXf4alb2EDNCCN2i9K6aq/t5pm6QHoTHU WGQJqCHW3c5yvTew9a84Q3FSvb0vAINRIsVO1gv04Xl35ObJsgte6R33WDCChkGtHRwIFU5OI2Q Xj23x7K5/NkYYg2Tvtg+sXRI43ICkidpN7d5savnAKAnUA+cRnFxhqKJN6ZzILJb5zPVzOEqwLV FcgibrHZMks/H6PYKNuU1fwTyrA/qVsJCBf1UkvSPCuIz+Ps3hMF3I+r4tkoi3V5lK8VQWV67PK 2PBBFk/p4QrUBPqRyE+aBFUb5yYWc= X-Received: by 2002:a05:6a00:1882:b0:827:455b:86b1 with SMTP id d2e1a72fcca58-829a2e786c5mr457884b3a.28.1772764300896; Thu, 05 Mar 2026 18:31:40 -0800 (PST) Received: from fedora ([209.132.188.88]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-829a4867e6asm66368b3a.32.2026.03.05.18.31.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Mar 2026 18:31:40 -0800 (PST) Date: Fri, 6 Mar 2026 02:31:28 +0000 From: Hangbin Liu To: Ricardo =?iso-8859-1?Q?B=2E_Marli=E8re?= Cc: Martin KaFai Lau , Daniel Borkmann , John Fastabend , Stanislav Fomichev , Alexei Starovoitov , Andrii Nakryiko , Eduard Zingerman , Song Liu , Yonghong Song , KP Singh , Hao Luo , Jiri Olsa , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Toke =?iso-8859-1?Q?H=F8iland-J=F8rgensen?= , David Ahern , Jay Vosburgh , Andrew Lunn , Fernando Fernandez Mancera , bpf@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH net v2 3/3] net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled Message-ID: References: <20260305-net-nd_tbl_fixes-v2-0-b7177db1a9f3@suse.com> <20260305-net-nd_tbl_fixes-v2-3-b7177db1a9f3@suse.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20260305-net-nd_tbl_fixes-v2-3-b7177db1a9f3@suse.com> On Thu, Mar 05, 2026 at 05:37:41PM -0300, Ricardo B. Marlière wrote: > When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never > initialized because inet6_init() exits before ndisc_init() is called > which initializes it. If bonding ARP/NS validation is enabled, an IPv6 > NS/NA packet received on a slave can reach bond_validate_na(), which > calls bond_has_this_ip6(). That path calls ipv6_chk_addr() and can > crash in __ipv6_chk_addr_and_flags(). > > BUG: kernel NULL pointer dereference, address: 00000000000005d8 > Oops: Oops: 0000 [#1] SMP NOPTI > RIP: 0010:__ipv6_chk_addr_and_flags+0x69/0x170 > Call Trace: > > ipv6_chk_addr+0x1f/0x30 > bond_validate_na+0x12e/0x1d0 [bonding] > ? __pfx_bond_handle_frame+0x10/0x10 [bonding] > bond_rcv_validate+0x1a0/0x450 [bonding] > bond_handle_frame+0x5e/0x290 [bonding] > ? srso_alias_return_thunk+0x5/0xfbef5 > __netif_receive_skb_core.constprop.0+0x3e8/0xe50 > ? srso_alias_return_thunk+0x5/0xfbef5 > ? update_cfs_rq_load_avg+0x1a/0x240 > ? srso_alias_return_thunk+0x5/0xfbef5 > ? __enqueue_entity+0x5e/0x240 > __netif_receive_skb_one_core+0x39/0xa0 > process_backlog+0x9c/0x150 > __napi_poll+0x30/0x200 > ? srso_alias_return_thunk+0x5/0xfbef5 > net_rx_action+0x338/0x3b0 > handle_softirqs+0xc9/0x2a0 > do_softirq+0x42/0x60 > > > __local_bh_enable_ip+0x62/0x70 > __dev_queue_xmit+0x2d3/0x1000 > ? srso_alias_return_thunk+0x5/0xfbef5 > ? srso_alias_return_thunk+0x5/0xfbef5 > ? packet_parse_headers+0x10a/0x1a0 > packet_sendmsg+0x10da/0x1700 > ? kick_pool+0x5f/0x140 > ? srso_alias_return_thunk+0x5/0xfbef5 > ? __queue_work+0x12d/0x4f0 > __sys_sendto+0x1f3/0x220 > __x64_sys_sendto+0x24/0x30 > do_syscall_64+0x101/0xf80 > ? exc_page_fault+0x6e/0x170 > ? srso_alias_return_thunk+0x5/0xfbef5 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > > > Fix this by adding an early check in bond_confirm_addr6(). If > ipv6_stub->nd_tbl is NULL, return before calling ipv6_chk_addr(). > > Suggested-by: Fernando Fernandez Mancera > Fixes: 4e24be018eb9 ("bonding: add new parameter ns_targets") > Signed-off-by: Ricardo B. Marlière > --- > drivers/net/bonding/bond_main.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c > index 14ed91391fcc..7d32cd231633 100644 > --- a/drivers/net/bonding/bond_main.c > +++ b/drivers/net/bonding/bond_main.c > @@ -3256,6 +3256,9 @@ static int bond_confirm_addr6(struct net_device *dev, > { > struct in6_addr *addr = (struct in6_addr *)priv->data; > > + if (unlikely(!ipv6_mod_enabled())) > + return 0; > + > return ipv6_chk_addr(dev_net(dev), addr, dev, 0); > } Hi Ricardo, Since the ipv6 has been disabled on the host, I'm a little wonder why don't we check it more early, e.g. in this if check #if IS_ENABLED(CONFIG_IPV6) } else if (is_ipv6) { return bond_na_rcv(skb, bond, slave); #endif Thanks Hangbin