From: Jiayuan Chen <mrpre@163.com>
To: Eric Dumazet <edumazet@google.com>,
"David S . Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>
Cc: Simon Horman <horms@kernel.org>,
netdev@vger.kernel.org, eric.dumazet@gmail.com,
Jiayuan Chen <jiayuan.chen@shopee.com>,
Jay Vosburgh <jv@jvosburgh.net>,
Andrew Lunn <andrew+netdev@lunn.ch>
Subject: Re: [PATCH net] bonding: prevent potential infinite loop in bond_header_parse()
Date: Sat, 14 Mar 2026 20:03:34 +0800 [thread overview]
Message-ID: <03134b09-5bcd-4898-bb2d-d866e1acd97a@163.com> (raw)
In-Reply-To: <20260314115650.3646361-1-edumazet@google.com>
On 3/14/26 7:56 PM, Eric Dumazet wrote:
> bond_header_parse() can loop if a stack of two bonding devices is setup,
> because skb->dev always points to the hierarchy top.
>
> Add new "const struct net_device *dev" parameter to
> (struct header_ops)->parse() method to make sure the recursion
> is bounded, and that the final leaf parse method is called.
>
> Fixes: 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Jiayuan Chen <jiayuan.chen@shopee.com>
> Cc: Jay Vosburgh <jv@jvosburgh.net>
> Cc: Andrew Lunn <andrew+netdev@lunn.ch>
> ---
> drivers/firewire/net.c | 5 +++--
> drivers/net/bonding/bond_main.c | 8 +++++---
> include/linux/etherdevice.h | 3 ++-
> include/linux/if_ether.h | 3 ++-
> include/linux/netdevice.h | 6 ++++--
> net/ethernet/eth.c | 3 ++-
> net/ipv4/ip_gre.c | 3 ++-
> net/mac802154/iface.c | 4 +++-
> net/phonet/af_phonet.c | 5 ++++-
> 9 files changed, 27 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
> index f1a2bee39bf113fe78f4640ba92a7b4e602c213a..82b3b6d9ed2df6423d5cb7a35282d01775e6cee5 100644
> --- a/drivers/firewire/net.c
> +++ b/drivers/firewire/net.c
> @@ -257,9 +257,10 @@ static void fwnet_header_cache_update(struct hh_cache *hh,
> memcpy((u8 *)hh->hh_data + HH_DATA_OFF(FWNET_HLEN), haddr, net->addr_len);
> }
>
> -static int fwnet_header_parse(const struct sk_buff *skb, unsigned char *haddr)
> +static int fwnet_header_parse(const struct sk_buff *skb, const struct net_device *dev,
> + unsigned char *haddr)
> {
> - memcpy(haddr, skb->dev->dev_addr, FWNET_ALEN);
> + memcpy(haddr, dev->dev_addr, FWNET_ALEN);
>
> return FWNET_ALEN;
> }
> diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
> index 707419270ebf217a71b0593880c7a9a1481b7171..33f414d03ab913c58cf2406a4ab25e611c528159 100644
> --- a/drivers/net/bonding/bond_main.c
> +++ b/drivers/net/bonding/bond_main.c
> @@ -1530,9 +1530,11 @@ static int bond_header_create(struct sk_buff *skb, struct net_device *bond_dev,
> return ret;
> }
>
> -static int bond_header_parse(const struct sk_buff *skb, unsigned char *haddr)
> +static int bond_header_parse(const struct sk_buff *skb,
> + const struct net_device *dev,
> + unsigned char *haddr)
> {
> - struct bonding *bond = netdev_priv(skb->dev);
> + struct bonding *bond = netdev_priv(dev);
> const struct header_ops *slave_ops;
> struct slave *slave;
> int ret = 0;
> @@ -1542,7 +1544,7 @@ static int bond_header_parse(const struct sk_buff *skb, unsigned char *haddr)
> if (slave) {
> slave_ops = READ_ONCE(slave->dev->header_ops);
> if (slave_ops && slave_ops->parse)
> - ret = slave_ops->parse(skb, haddr);
> + ret = slave_ops->parse(skb, slave->dev, haddr);
> }
> rcu_read_unlock();
> return ret;
> diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
> index 9a1eacf35d37087ba8877bf31c017445929041ed..df8f88f63a7063fbd1df5248d2fc02c859a7bc74 100644
> --- a/include/linux/etherdevice.h
> +++ b/include/linux/etherdevice.h
> @@ -42,7 +42,8 @@ extern const struct header_ops eth_header_ops;
>
> int eth_header(struct sk_buff *skb, struct net_device *dev, unsigned short type,
> const void *daddr, const void *saddr, unsigned len);
> -int eth_header_parse(const struct sk_buff *skb, unsigned char *haddr);
> +int eth_header_parse(const struct sk_buff *skb, const struct net_device *dev,
> + unsigned char *haddr);
> int eth_header_cache(const struct neighbour *neigh, struct hh_cache *hh,
> __be16 type);
> void eth_header_cache_update(struct hh_cache *hh, const struct net_device *dev,
> diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h
> index 61b7335aa037c7232a0caa45572043057c02dde3..ca9afa824aa4faf832658043bda6fb430633e476 100644
> --- a/include/linux/if_ether.h
> +++ b/include/linux/if_ether.h
> @@ -40,7 +40,8 @@ static inline struct ethhdr *inner_eth_hdr(const struct sk_buff *skb)
> return (struct ethhdr *)skb_inner_mac_header(skb);
> }
>
> -int eth_header_parse(const struct sk_buff *skb, unsigned char *haddr);
> +int eth_header_parse(const struct sk_buff *skb, const struct net_device *dev,
> + unsigned char *haddr);
>
> extern ssize_t sysfs_format_mac(char *buf, const unsigned char *addr, int len);
>
> diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
> index d7aac6f185bcab8a93a204c349272fc7c1b15ee7..7ca01eb3f7d2b22a188502583dc95121adff7cc9 100644
> --- a/include/linux/netdevice.h
> +++ b/include/linux/netdevice.h
> @@ -311,7 +311,9 @@ struct header_ops {
> int (*create) (struct sk_buff *skb, struct net_device *dev,
> unsigned short type, const void *daddr,
> const void *saddr, unsigned int len);
> - int (*parse)(const struct sk_buff *skb, unsigned char *haddr);
> + int (*parse)(const struct sk_buff *skb,
> + const struct net_device *dev,
> + unsigned char *haddr);
> int (*cache)(const struct neighbour *neigh, struct hh_cache *hh, __be16 type);
> void (*cache_update)(struct hh_cache *hh,
> const struct net_device *dev,
> @@ -3445,7 +3447,7 @@ static inline int dev_parse_header(const struct sk_buff *skb,
>
> if (!dev->header_ops || !dev->header_ops->parse)
> return 0;
> - return dev->header_ops->parse(skb, haddr);
> + return dev->header_ops->parse(skb, dev, haddr);
> }
>
> static inline __be16 dev_parse_header_protocol(const struct sk_buff *skb)
> diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
> index 13a63b48b7eeb896dfe98eb0070a261eed2c384b..9d159d1cc57d42747f794cdf43fe0ccaf04818b2 100644
> --- a/net/ethernet/eth.c
> +++ b/net/ethernet/eth.c
> @@ -198,7 +198,8 @@ EXPORT_SYMBOL(eth_type_trans);
> * @skb: packet to extract header from
> * @haddr: destination buffer
> */
> -int eth_header_parse(const struct sk_buff *skb, unsigned char *haddr)
> +int eth_header_parse(const struct sk_buff *skb, const struct net_device *dev,
> + unsigned char *haddr)
> {
> const struct ethhdr *eth = eth_hdr(skb);
> memcpy(haddr, eth->h_source, ETH_ALEN);
> diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
> index e13244729ad8d5b1c2b9c483d25bff0e438134b5..35f0baa99d4092fd499a4795f7f52db33a1fe4e2 100644
> --- a/net/ipv4/ip_gre.c
> +++ b/net/ipv4/ip_gre.c
> @@ -919,7 +919,8 @@ static int ipgre_header(struct sk_buff *skb, struct net_device *dev,
> return -(t->hlen + sizeof(*iph));
> }
>
> -static int ipgre_header_parse(const struct sk_buff *skb, unsigned char *haddr)
> +static int ipgre_header_parse(const struct sk_buff *skb, const struct net_device *dev,
> + unsigned char *haddr)
> {
> const struct iphdr *iph = (const struct iphdr *) skb_mac_header(skb);
> memcpy(haddr, &iph->saddr, 4);
> diff --git a/net/mac802154/iface.c b/net/mac802154/iface.c
> index 9e4631fade90c980887803f313727e9ff943bc73..000be60d9580343e40f33ff872ec0aff7daa41d0 100644
> --- a/net/mac802154/iface.c
> +++ b/net/mac802154/iface.c
> @@ -469,7 +469,9 @@ static int mac802154_header_create(struct sk_buff *skb,
> }
>
> static int
> -mac802154_header_parse(const struct sk_buff *skb, unsigned char *haddr)
> +mac802154_header_parse(const struct sk_buff *skb,
> + const struct net_device *dev,
> + unsigned char *haddr)
> {
> struct ieee802154_hdr hdr;
>
> diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
> index 238a9638d2b0f6a23070b0871515302d8cba864f..d89225d6bfd3bf7668edf3d0fe563f7bbc97de2c 100644
> --- a/net/phonet/af_phonet.c
> +++ b/net/phonet/af_phonet.c
> @@ -129,9 +129,12 @@ static int pn_header_create(struct sk_buff *skb, struct net_device *dev,
> return 1;
> }
>
> -static int pn_header_parse(const struct sk_buff *skb, unsigned char *haddr)
> +static int pn_header_parse(const struct sk_buff *skb,
> + const struct net_device *dev,
> + unsigned char *haddr)
> {
> const u8 *media = skb_mac_header(skb);
> +
> *haddr = *media;
> return 1;
> }
My bad, I missed the recursion issue with stacked bonds.
I reproduced it and verified the fix works correctly.
And I will add a test to tools/testing/selftests.
Reviewed-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Tested-by: Jiayuan Chen <jiayuan.chen@shopee.com>
next prev parent reply other threads:[~2026-03-14 12:05 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-14 11:56 [PATCH net] bonding: prevent potential infinite loop in bond_header_parse() Eric Dumazet
2026-03-14 12:03 ` Jiayuan Chen [this message]
2026-03-14 12:07 ` Eric Dumazet
2026-03-14 17:50 ` Jakub Kicinski
2026-03-14 17:59 ` Eric Dumazet
2026-03-15 3:42 ` kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=03134b09-5bcd-4898-bb2d-d866e1acd97a@163.com \
--to=mrpre@163.com \
--cc=andrew+netdev@lunn.ch \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=eric.dumazet@gmail.com \
--cc=horms@kernel.org \
--cc=jiayuan.chen@shopee.com \
--cc=jv@jvosburgh.net \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox