Re: [PATCH net] net/mlx5: Fix slab-out-of-bounds when handling team device events

[Mark Bloch <mbloch@nvidia.com>]

On 22/09/2026 16:51, Anirudh Virdi wrote:
> The mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event()
> functions assume the upper device is a bonding device and call bonding-
> specific
> APIs like bond_slave_get_rcu() and bond_is_slave_inactive().
> 
> When a device is enslaved to a team master instead of bonding, the code
> attempts to access the team_port structure as if it were a bond slave
> structure. Since team_port is smaller than slave, this causes KASAN to
> detect an out-of-bounds memory access.
> 
> Fix this by checking explicitly for bonding devices using
> netif_is_bond_master() instead of the generic netif_is_lag_master() which
> includes both bonding and team devices. This ensures mlx5 only processes
> bonding events, not team events, preventing the invalid memory access.
> 
> Tested with Mellanox ConnectX-5 on Linux 7.2.0-rc6:
> - Bonding: PASS (no regressions)
> - Team device: PASS (no KASAN errors)
> 
> Fixes: 54493a08e21f ("net/mlx5: Lag, record inactive state of bond device")
> Signed-off-by: Anirudh Virdi <avirdi@redhat.com>
> ---
>  drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
> index 28d16fdc3f06..022a69cdebaf 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
> @@ -1897,7 +1897,7 @@ static int mlx5_handle_changeupper_event(struct mlx5_lag *ldev,
>  	int changed = 0;
>  	int i, idx = -1;
>  
> -	if (!netif_is_lag_master(upper))
> +	if (!netif_is_bond_master(upper))

I think blocking teams might not be what we want to do, what about

@@ -1923,9 +1923,11 @@ static int mlx5_handle_changeupper_event(struct mlx5_lag *ldev,
                      }
              }
              if (i < MLX5_MAX_PORTS) {
-                     slave = bond_slave_get_rcu(ndev_tmp);
-                     if (slave)
-                             has_inactive |= bond_is_slave_inactive(slave);
+                     if (netif_is_bond_master(upper)) {
+                             slave = bond_slave_get_rcu(ndev_tmp);
+                             if (slave)
+                                     has_inactive |= bond_is_slave_inactive(slave);
+                     }
                      bond_status |= (1 << idx);
              }

I think this works better.
>  		return 0;
>  
>  	if (info->linking)
> @@ -2004,7 +2004,7 @@ static int mlx5_handle_changeinfodata_event(struct mlx5_lag *ldev,
>  	bool has_inactive = 0;
>  	int idx;
>  
> -	if (!netif_is_lag_master(ndev))
> +	if (!netif_is_bond_master(ndev))

I'm okay with this as mlx5 doesn't handle state for teams ports anyway.

Mark


>  		return 0;
>  
>  	rcu_read_lock();