Re: [PATCH net v2] net/mlx5: Fix slab-out-of-bounds when handling team device events

[Mark Bloch <mbloch@nvidia.com>]

On 24/09/2026 9:42, Anirudh Virdi wrote:
> The mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event()
> functions check for LAG masters (which includes both bonding and team
> devices) but only call bonding-specific APIs. When processing team device
> events, calling bond_slave_get_rcu() and bond_is_slave_inactive() on
> team_port structures causes KASAN to detect an out-of-bounds memory access
> since team_port is smaller than bond slave.
> 
> Fix this by wrapping the bond-specific API calls with a check for bonding
> devices. This allows the function to still process LAG events for both
> bonding and teams but only calls bond-specific functions when dealing with
> actual bonding devices.
> 
> For mlx5_handle_changeinfodata_event(), keep the explicit bond check as
> mlx5 doesn't handle state information for team ports anyway.
> 
> Tested with Mellanox ConnectX-5 on Linux 7.2.0-rc6:
> - Bonding: PASS (no regressions)
> - Team device: PASS (no KASAN errors)
> 
> Fixes: 54493a08e21f ("net/mlx5: Lag, record inactive state of bond device")
> Suggested-by: Mark Bloch <mbloch@nvidia.com>
> Signed-off-by: Anirudh Virdi <avirdi@redhat.com>

Thanks for the patch,

Reviewed-by: Mark Bloch <mbloch@nvidia.com>

Mark

> ---
> Changes in v2:
> - Changed mlx5_handle_changeupper_event() to keep netif_is_lag_master() check
>   instead of using netif_is_bond_master() at the start
> - Wrapped bond-specific API calls (bond_slave_get_rcu, bond_is_slave_inactive)
>   with an explicit netif_is_bond_master() check inside the loop
> - This allows both bonding and team events to be processed, but only calls
>   bond-specific functions for actual bonding devices
> - Suggested-by: Mark Bloch <mbloch@nvidia.com>
> - Tested on hardware to confirm both bonding and team devices work without KASAN errors
> 
>  drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
> index 28d16fdc3f06..1c4107d9a408 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
> @@ -1918,9 +1918,11 @@ static int mlx5_handle_changeupper_event(struct mlx5_lag *ldev,
>  			}
>  		}
>  		if (i < MLX5_MAX_PORTS) {
> -			slave = bond_slave_get_rcu(ndev_tmp);
> -			if (slave)
> -				has_inactive |= bond_is_slave_inactive(slave);
> +			if (netif_is_bond_master(upper)) {
> +				slave = bond_slave_get_rcu(ndev_tmp);
> +				if (slave)
> +					has_inactive |= bond_is_slave_inactive(slave);
> +			}
>  			bond_status |= (1 << idx);
>  		}
>  
> @@ -2004,7 +2006,7 @@ static int mlx5_handle_changeinfodata_event(struct mlx5_lag *ldev,
>  	bool has_inactive = 0;
>  	int idx;
>  
> -	if (!netif_is_lag_master(ndev))
> +	if (!netif_is_bond_master(ndev))
>  		return 0;
>  
>  	rcu_read_lock();