* [PATCH net] bonding: fix devconf_all NULL dereference when IPv6 is disabled
@ 2026-07-07 1:06 zhangzl2013
2026-07-07 10:35 ` Vadim Fedorenko
2026-07-07 11:41 ` Hangbin Liu
0 siblings, 2 replies; 4+ messages in thread
From: zhangzl2013 @ 2026-07-07 1:06 UTC (permalink / raw)
To: Zhaolong Zhang, Jay Vosburgh, Andrew Lunn, Jakub Kicinski
Cc: David S . Miller, Eric Dumazet, Paolo Abeni, Hangbin Liu, netdev,
linux-kernel, Qianheng Peng, Zhaolong Zhang
From: Zhaolong Zhang <zhangzl68@chinatelecom.cn>
When booting with the 'ipv6.disable=1' parameter, the devconf_all is
never initialized because inet6_init() exits before addrconf_init() is
called which initializes it. bond_send_validate(), however, will still
call bond_ns_send_all() even ipv6 is indeed disabled. It will lead to
NULL derefence of net->ipv6.devconf_all in ip6_pol_route().
BUG: kernel NULL pointer dereference, address: 000000000000000c
[...]
Workqueue: bond0 bond_arp_monitor [bonding]
RIP: 0010:ip6_pol_route+0x69/0x480
[...]
Call Trace:
<TASK>
? srso_return_thunk+0x5/0x5f
? __pfx_ip6_pol_route_output+0x10/0x10
fib6_rule_lookup+0xfe/0x260
? wakeup_preempt+0x8a/0x90
? srso_return_thunk+0x5/0x5f
? srso_return_thunk+0x5/0x5f
? sched_balance_rq+0x369/0x810
ip6_route_output_flags+0xd7/0x170
bond_ns_send_all+0xde/0x280 [bonding]
bond_ab_arp_probe+0x296/0x320 [bonding]
? srso_return_thunk+0x5/0x5f
bond_activebackup_arp_mon+0xb4/0x2c0 [bonding]
process_one_work+0x196/0x370
worker_thread+0x1af/0x320
? srso_return_thunk+0x5/0x5f
? __pfx_worker_thread+0x10/0x10
kthread+0xe3/0x120
? __pfx_kthread+0x10/0x10
ret_from_fork+0x199/0x260
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Fix this by adding ipv6_mod_enabled() condition check in the caller.
Fixes: 4e24be018eb9 ("bonding: add new parameter ns_targets")
Signed-off-by: Qianheng Peng <pengqh1@chinatelecom.cn>
Signed-off-by: Zhaolong Zhang <zhangzl68@chinatelecom.cn>
---
drivers/net/bonding/bond_main.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index e044fc733b8c..522eab060f9e 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3455,7 +3455,8 @@ static void bond_send_validate(struct bonding *bond, struct slave *slave)
{
bond_arp_send_all(bond, slave);
#if IS_ENABLED(CONFIG_IPV6)
- bond_ns_send_all(bond, slave);
+ if (likely(ipv6_mod_enabled()))
+ bond_ns_send_all(bond, slave);
#endif
}
--
2.52.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net] bonding: fix devconf_all NULL dereference when IPv6 is disabled
2026-07-07 1:06 [PATCH net] bonding: fix devconf_all NULL dereference when IPv6 is disabled zhangzl2013
@ 2026-07-07 10:35 ` Vadim Fedorenko
2026-07-07 11:40 ` Hangbin Liu
2026-07-07 11:41 ` Hangbin Liu
1 sibling, 1 reply; 4+ messages in thread
From: Vadim Fedorenko @ 2026-07-07 10:35 UTC (permalink / raw)
To: zhangzl2013, Jay Vosburgh, Andrew Lunn, Jakub Kicinski
Cc: David S . Miller, Eric Dumazet, Paolo Abeni, Hangbin Liu, netdev,
linux-kernel, Qianheng Peng, Zhaolong Zhang
On 07/07/2026 02:06, zhangzl2013@126.com wrote:
> From: Zhaolong Zhang <zhangzl68@chinatelecom.cn>
>
> When booting with the 'ipv6.disable=1' parameter, the devconf_all is
> never initialized because inet6_init() exits before addrconf_init() is
> called which initializes it. bond_send_validate(), however, will still
> call bond_ns_send_all() even ipv6 is indeed disabled. It will lead to
> NULL derefence of net->ipv6.devconf_all in ip6_pol_route().
>
> BUG: kernel NULL pointer dereference, address: 000000000000000c
> [...]
> Workqueue: bond0 bond_arp_monitor [bonding]
> RIP: 0010:ip6_pol_route+0x69/0x480
> [...]
> Call Trace:
> <TASK>
> ? srso_return_thunk+0x5/0x5f
> ? __pfx_ip6_pol_route_output+0x10/0x10
> fib6_rule_lookup+0xfe/0x260
> ? wakeup_preempt+0x8a/0x90
> ? srso_return_thunk+0x5/0x5f
> ? srso_return_thunk+0x5/0x5f
> ? sched_balance_rq+0x369/0x810
> ip6_route_output_flags+0xd7/0x170
> bond_ns_send_all+0xde/0x280 [bonding]
> bond_ab_arp_probe+0x296/0x320 [bonding]
> ? srso_return_thunk+0x5/0x5f
> bond_activebackup_arp_mon+0xb4/0x2c0 [bonding]
> process_one_work+0x196/0x370
> worker_thread+0x1af/0x320
> ? srso_return_thunk+0x5/0x5f
> ? __pfx_worker_thread+0x10/0x10
> kthread+0xe3/0x120
> ? __pfx_kthread+0x10/0x10
> ret_from_fork+0x199/0x260
> ? __pfx_kthread+0x10/0x10
> ret_from_fork_asm+0x1a/0x30
> </TASK>
>
> Fix this by adding ipv6_mod_enabled() condition check in the caller.
>
> Fixes: 4e24be018eb9 ("bonding: add new parameter ns_targets")
> Signed-off-by: Qianheng Peng <pengqh1@chinatelecom.cn>
> Signed-off-by: Zhaolong Zhang <zhangzl68@chinatelecom.cn>
> ---
> drivers/net/bonding/bond_main.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
> index e044fc733b8c..522eab060f9e 100644
> --- a/drivers/net/bonding/bond_main.c
> +++ b/drivers/net/bonding/bond_main.c
> @@ -3455,7 +3455,8 @@ static void bond_send_validate(struct bonding *bond, struct slave *slave)
> {
> bond_arp_send_all(bond, slave);
> #if IS_ENABLED(CONFIG_IPV6)
> - bond_ns_send_all(bond, slave);
> + if (likely(ipv6_mod_enabled()))
> + bond_ns_send_all(bond, slave);
> #endif
> }
>
ipv6_mod_enabled() doesn't depend on CONFIG_IPV6, please, remove
#if IS_ENABLED as well
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net] bonding: fix devconf_all NULL dereference when IPv6 is disabled
2026-07-07 10:35 ` Vadim Fedorenko
@ 2026-07-07 11:40 ` Hangbin Liu
0 siblings, 0 replies; 4+ messages in thread
From: Hangbin Liu @ 2026-07-07 11:40 UTC (permalink / raw)
To: Vadim Fedorenko
Cc: zhangzl2013, Jay Vosburgh, Andrew Lunn, Jakub Kicinski,
David S . Miller, Eric Dumazet, Paolo Abeni, netdev, linux-kernel,
Qianheng Peng, Zhaolong Zhang
On Tue, Jul 7, 2026 at 6:35 PM Vadim Fedorenko
<vadim.fedorenko@linux.dev> wrote:
>
> On 07/07/2026 02:06, zhangzl2013@126.com wrote:
> > From: Zhaolong Zhang <zhangzl68@chinatelecom.cn>
> >
> > When booting with the 'ipv6.disable=1' parameter, the devconf_all is
> > never initialized because inet6_init() exits before addrconf_init() is
> > called which initializes it. bond_send_validate(), however, will still
> > call bond_ns_send_all() even ipv6 is indeed disabled. It will lead to
> > NULL derefence of net->ipv6.devconf_all in ip6_pol_route().
> >
> > BUG: kernel NULL pointer dereference, address: 000000000000000c
> > [...]
> > Workqueue: bond0 bond_arp_monitor [bonding]
> > RIP: 0010:ip6_pol_route+0x69/0x480
> > [...]
> > Call Trace:
> > <TASK>
> > ? srso_return_thunk+0x5/0x5f
> > ? __pfx_ip6_pol_route_output+0x10/0x10
> > fib6_rule_lookup+0xfe/0x260
> > ? wakeup_preempt+0x8a/0x90
> > ? srso_return_thunk+0x5/0x5f
> > ? srso_return_thunk+0x5/0x5f
> > ? sched_balance_rq+0x369/0x810
> > ip6_route_output_flags+0xd7/0x170
> > bond_ns_send_all+0xde/0x280 [bonding]
> > bond_ab_arp_probe+0x296/0x320 [bonding]
> > ? srso_return_thunk+0x5/0x5f
> > bond_activebackup_arp_mon+0xb4/0x2c0 [bonding]
> > process_one_work+0x196/0x370
> > worker_thread+0x1af/0x320
> > ? srso_return_thunk+0x5/0x5f
> > ? __pfx_worker_thread+0x10/0x10
> > kthread+0xe3/0x120
> > ? __pfx_kthread+0x10/0x10
> > ret_from_fork+0x199/0x260
> > ? __pfx_kthread+0x10/0x10
> > ret_from_fork_asm+0x1a/0x30
> > </TASK>
> >
> > Fix this by adding ipv6_mod_enabled() condition check in the caller.
> >
> > Fixes: 4e24be018eb9 ("bonding: add new parameter ns_targets")
> > Signed-off-by: Qianheng Peng <pengqh1@chinatelecom.cn>
> > Signed-off-by: Zhaolong Zhang <zhangzl68@chinatelecom.cn>
> > ---
> > drivers/net/bonding/bond_main.c | 3 ++-
> > 1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
> > index e044fc733b8c..522eab060f9e 100644
> > --- a/drivers/net/bonding/bond_main.c
> > +++ b/drivers/net/bonding/bond_main.c
> > @@ -3455,7 +3455,8 @@ static void bond_send_validate(struct bonding *bond, struct slave *slave)
> > {
> > bond_arp_send_all(bond, slave);
> > #if IS_ENABLED(CONFIG_IPV6)
> > - bond_ns_send_all(bond, slave);
> > + if (likely(ipv6_mod_enabled()))
> > + bond_ns_send_all(bond, slave);
> > #endif
> > }
> >
>
> ipv6_mod_enabled() doesn't depend on CONFIG_IPV6, please, remove
> #if IS_ENABLED as well
No, bond_ns_send_all() is static and protected by IS_ENABLED(CONFIG_IPV6).
Remove this IS_ENABLED will cause build error.
Thanks
Hangbin
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net] bonding: fix devconf_all NULL dereference when IPv6 is disabled
2026-07-07 1:06 [PATCH net] bonding: fix devconf_all NULL dereference when IPv6 is disabled zhangzl2013
2026-07-07 10:35 ` Vadim Fedorenko
@ 2026-07-07 11:41 ` Hangbin Liu
1 sibling, 0 replies; 4+ messages in thread
From: Hangbin Liu @ 2026-07-07 11:41 UTC (permalink / raw)
To: zhangzl2013
Cc: Jay Vosburgh, Andrew Lunn, Jakub Kicinski, David S . Miller,
Eric Dumazet, Paolo Abeni, netdev, linux-kernel, Qianheng Peng,
Zhaolong Zhang
On Tue, Jul 7, 2026 at 9:07 AM <zhangzl2013@126.com> wrote:
>
> From: Zhaolong Zhang <zhangzl68@chinatelecom.cn>
>
> When booting with the 'ipv6.disable=1' parameter, the devconf_all is
> never initialized because inet6_init() exits before addrconf_init() is
> called which initializes it. bond_send_validate(), however, will still
> call bond_ns_send_all() even ipv6 is indeed disabled. It will lead to
> NULL derefence of net->ipv6.devconf_all in ip6_pol_route().
>
> BUG: kernel NULL pointer dereference, address: 000000000000000c
> [...]
> Workqueue: bond0 bond_arp_monitor [bonding]
> RIP: 0010:ip6_pol_route+0x69/0x480
> [...]
> Call Trace:
> <TASK>
> ? srso_return_thunk+0x5/0x5f
> ? __pfx_ip6_pol_route_output+0x10/0x10
> fib6_rule_lookup+0xfe/0x260
> ? wakeup_preempt+0x8a/0x90
> ? srso_return_thunk+0x5/0x5f
> ? srso_return_thunk+0x5/0x5f
> ? sched_balance_rq+0x369/0x810
> ip6_route_output_flags+0xd7/0x170
> bond_ns_send_all+0xde/0x280 [bonding]
> bond_ab_arp_probe+0x296/0x320 [bonding]
> ? srso_return_thunk+0x5/0x5f
> bond_activebackup_arp_mon+0xb4/0x2c0 [bonding]
> process_one_work+0x196/0x370
> worker_thread+0x1af/0x320
> ? srso_return_thunk+0x5/0x5f
> ? __pfx_worker_thread+0x10/0x10
> kthread+0xe3/0x120
> ? __pfx_kthread+0x10/0x10
> ret_from_fork+0x199/0x260
> ? __pfx_kthread+0x10/0x10
> ret_from_fork_asm+0x1a/0x30
> </TASK>
>
> Fix this by adding ipv6_mod_enabled() condition check in the caller.
>
> Fixes: 4e24be018eb9 ("bonding: add new parameter ns_targets")
> Signed-off-by: Qianheng Peng <pengqh1@chinatelecom.cn>
> Signed-off-by: Zhaolong Zhang <zhangzl68@chinatelecom.cn>
> ---
> drivers/net/bonding/bond_main.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
> index e044fc733b8c..522eab060f9e 100644
> --- a/drivers/net/bonding/bond_main.c
> +++ b/drivers/net/bonding/bond_main.c
> @@ -3455,7 +3455,8 @@ static void bond_send_validate(struct bonding *bond, struct slave *slave)
> {
> bond_arp_send_all(bond, slave);
> #if IS_ENABLED(CONFIG_IPV6)
> - bond_ns_send_all(bond, slave);
> + if (likely(ipv6_mod_enabled()))
> + bond_ns_send_all(bond, slave);
> #endif
> }
>
Thanks for your fix. Next time please use PATCHv2 with a change log.
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-07-07 11:41 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-07 1:06 [PATCH net] bonding: fix devconf_all NULL dereference when IPv6 is disabled zhangzl2013
2026-07-07 10:35 ` Vadim Fedorenko
2026-07-07 11:40 ` Hangbin Liu
2026-07-07 11:41 ` Hangbin Liu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox