[PATCH net v2] net/mlx5: Fix slab-out-of-bounds when handling team device events

[PATCH net v2] net/mlx5: Fix slab-out-of-bounds when handling team device events

[Anirudh Virdi]

The mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event()
functions check for LAG masters (which includes both bonding and team
devices) but only call bonding-specific APIs. When processing team device
events, calling bond_slave_get_rcu() and bond_is_slave_inactive() on
team_port structures causes KASAN to detect an out-of-bounds memory access
since team_port is smaller than bond slave.

Fix this by wrapping the bond-specific API calls with a check for bonding
devices. This allows the function to still process LAG events for both
bonding and teams but only calls bond-specific functions when dealing with
actual bonding devices.

For mlx5_handle_changeinfodata_event(), keep the explicit bond check as
mlx5 doesn't handle state information for team ports anyway.

Tested with Mellanox ConnectX-5 on Linux 7.2.0-rc6:
- Bonding: PASS (no regressions)
- Team device: PASS (no KASAN errors)

Fixes: 54493a08e21f ("net/mlx5: Lag, record inactive state of bond device")
Suggested-by: Mark Bloch <mbloch@nvidia.com>
Signed-off-by: Anirudh Virdi <avirdi@redhat.com>
---
Changes in v2:
- Changed mlx5_handle_changeupper_event() to keep netif_is_lag_master() check
  instead of using netif_is_bond_master() at the start
- Wrapped bond-specific API calls (bond_slave_get_rcu, bond_is_slave_inactive)
  with an explicit netif_is_bond_master() check inside the loop
- This allows both bonding and team events to be processed, but only calls
  bond-specific functions for actual bonding devices
- Suggested-by: Mark Bloch <mbloch@nvidia.com>
- Tested on hardware to confirm both bonding and team devices work without KASAN errors

 drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
index 28d16fdc3f06..1c4107d9a408 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
@@ -1918,9 +1918,11 @@ static int mlx5_handle_changeupper_event(struct mlx5_lag *ldev,
 			}
 		}
 		if (i < MLX5_MAX_PORTS) {
-			slave = bond_slave_get_rcu(ndev_tmp);
-			if (slave)
-				has_inactive |= bond_is_slave_inactive(slave);
+			if (netif_is_bond_master(upper)) {
+				slave = bond_slave_get_rcu(ndev_tmp);
+				if (slave)
+					has_inactive |= bond_is_slave_inactive(slave);
+			}
 			bond_status |= (1 << idx);
 		}
 
@@ -2004,7 +2006,7 @@ static int mlx5_handle_changeinfodata_event(struct mlx5_lag *ldev,
 	bool has_inactive = 0;
 	int idx;
 
-	if (!netif_is_lag_master(ndev))
+	if (!netif_is_bond_master(ndev))
 		return 0;
 
 	rcu_read_lock();
-- 
2.55.0

Re: [PATCH net v2] net/mlx5: Fix slab-out-of-bounds when handling team device events

[Mark Bloch]

On 24/09/2026 9:42, Anirudh Virdi wrote:
> The mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event()
> functions check for LAG masters (which includes both bonding and team
> devices) but only call bonding-specific APIs. When processing team device
> events, calling bond_slave_get_rcu() and bond_is_slave_inactive() on
> team_port structures causes KASAN to detect an out-of-bounds memory access
> since team_port is smaller than bond slave.
> 
> Fix this by wrapping the bond-specific API calls with a check for bonding
> devices. This allows the function to still process LAG events for both
> bonding and teams but only calls bond-specific functions when dealing with
> actual bonding devices.
> 
> For mlx5_handle_changeinfodata_event(), keep the explicit bond check as
> mlx5 doesn't handle state information for team ports anyway.
> 
> Tested with Mellanox ConnectX-5 on Linux 7.2.0-rc6:
> - Bonding: PASS (no regressions)
> - Team device: PASS (no KASAN errors)
> 
> Fixes: 54493a08e21f ("net/mlx5: Lag, record inactive state of bond device")
> Suggested-by: Mark Bloch <mbloch@nvidia.com>
> Signed-off-by: Anirudh Virdi <avirdi@redhat.com>

Thanks for the patch,

Reviewed-by: Mark Bloch <mbloch@nvidia.com>

Mark

> ---
> Changes in v2:
> - Changed mlx5_handle_changeupper_event() to keep netif_is_lag_master() check
>   instead of using netif_is_bond_master() at the start
> - Wrapped bond-specific API calls (bond_slave_get_rcu, bond_is_slave_inactive)
>   with an explicit netif_is_bond_master() check inside the loop
> - This allows both bonding and team events to be processed, but only calls
>   bond-specific functions for actual bonding devices
> - Suggested-by: Mark Bloch <mbloch@nvidia.com>
> - Tested on hardware to confirm both bonding and team devices work without KASAN errors
> 
>  drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
> index 28d16fdc3f06..1c4107d9a408 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
> @@ -1918,9 +1918,11 @@ static int mlx5_handle_changeupper_event(struct mlx5_lag *ldev,
>  			}
>  		}
>  		if (i < MLX5_MAX_PORTS) {
> -			slave = bond_slave_get_rcu(ndev_tmp);
> -			if (slave)
> -				has_inactive |= bond_is_slave_inactive(slave);
> +			if (netif_is_bond_master(upper)) {
> +				slave = bond_slave_get_rcu(ndev_tmp);
> +				if (slave)
> +					has_inactive |= bond_is_slave_inactive(slave);
> +			}
>  			bond_status |= (1 << idx);
>  		}
>  
> @@ -2004,7 +2006,7 @@ static int mlx5_handle_changeinfodata_event(struct mlx5_lag *ldev,
>  	bool has_inactive = 0;
>  	int idx;
>  
> -	if (!netif_is_lag_master(ndev))
> +	if (!netif_is_bond_master(ndev))
>  		return 0;
>  
>  	rcu_read_lock();

Re: [PATCH net v2] net/mlx5: Fix slab-out-of-bounds when handling team device events

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 24 Sep 2026 12:12:44 +0530 you wrote:
> The mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event()
> functions check for LAG masters (which includes both bonding and team
> devices) but only call bonding-specific APIs. When processing team device
> events, calling bond_slave_get_rcu() and bond_is_slave_inactive() on
> team_port structures causes KASAN to detect an out-of-bounds memory access
> since team_port is smaller than bond slave.
> 
> [...]

Here is the summary with links:
  - [net,v2] net/mlx5: Fix slab-out-of-bounds when handling team device events
    https://git.kernel.org/netdev/net/c/04c824940d52

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html