Re: [PATCH net] net: bonding: fix possible NULL deref in rlb code

[Jay Vosburgh <jay.vosburgh@canonical.com>]

Eric Dumazet <edumazet@google.com> wrote:

>syzbot has two reports involving the same root cause.
>
>bond_alb_initialize() must not set bond->alb_info.rlb_enabled
>if a memory allocation error is detected.
>
[...]
>
>Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
>Reported-by: syzbot <syzkaller@googlegroups.com>
>Signed-off-by: Eric Dumazet <edumazet@google.com>
>Cc: Jay Vosburgh <j.vosburgh@gmail.com>
>Cc: Veaceslav Falico <vfalico@gmail.com>
>Cc: Andy Gospodarek <andy@greyhouse.net>

Acked-by: Jay Vosburgh <jay.vosburgh@canonical.com>


>---
> drivers/net/bonding/bond_alb.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
>index 303c8d32d451e24345222ec105a1986d53a94eb4..007d43e46dcb0cb1cee1f23623bd161a6c32a45c 100644
>--- a/drivers/net/bonding/bond_alb.c
>+++ b/drivers/net/bonding/bond_alb.c
>@@ -1302,12 +1302,12 @@ int bond_alb_initialize(struct bonding *bond, int rlb_enabled)
> 		return res;
> 
> 	if (rlb_enabled) {
>-		bond->alb_info.rlb_enabled = 1;
> 		res = rlb_initialize(bond);
> 		if (res) {
> 			tlb_deinitialize(bond);
> 			return res;
> 		}
>+		bond->alb_info.rlb_enabled = 1;
> 	} else {
> 		bond->alb_info.rlb_enabled = 0;
> 	}
>-- 
>2.37.0.rc0.161.g10f37bed90-goog
>