Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

bonding: fix NULL pointer dereference in actor_port_prio setting

Liang reported an issue where setting a slave’s actor_port_prio to
predefined values such as 0, 255, or 65535 would cause a system crash.

The problem occurs because in bond_opt_parse(), when the provided value
matches a predefined table entry, the function returns that table entry,
which does not contain slave information. Later, in
bond_option_actor_port_prio_set(), calling bond_slave_get_rtnl() leads
to a NULL pointer dereference.

Since actor_port_prio is defined as a u16 and initialized to the default
value of 255 in ad_initialize_port(), there is no need for the
bond_actor_port_prio_tbl. Using the BOND_OPTFLAG_RAWVAL flag is sufficient.

Fixes: 6b6dc81ee7e8 ("bonding: add support for per-port LACP actor priority")
Reported-by: Liang Li <liali@redhat.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Link: https://patch.msgid.link/20251105072620.164841-1-liuhangbin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Hangbin Liu and committed by
Jakub Kicinski
067bf016 96baf482

+1 -8
+1 -8
drivers/net/bonding/bond_options.c
··· 225 225 { NULL, -1, 0}, 226 226 }; 227 227 228 - static const struct bond_opt_value bond_actor_port_prio_tbl[] = { 229 - { "minval", 0, BOND_VALFLAG_MIN}, 230 - { "maxval", 65535, BOND_VALFLAG_MAX}, 231 - { "default", 255, BOND_VALFLAG_DEFAULT}, 232 - { NULL, -1, 0}, 233 - }; 234 - 235 228 static const struct bond_opt_value bond_ad_user_port_key_tbl[] = { 236 229 { "minval", 0, BOND_VALFLAG_MIN | BOND_VALFLAG_DEFAULT}, 237 230 { "maxval", 1023, BOND_VALFLAG_MAX}, ··· 490 497 .id = BOND_OPT_ACTOR_PORT_PRIO, 491 498 .name = "actor_port_prio", 492 499 .unsuppmodes = BOND_MODE_ALL_EX(BIT(BOND_MODE_8023AD)), 493 - .values = bond_actor_port_prio_tbl, 500 + .flags = BOND_OPTFLAG_RAWVAL, 494 501 .set = bond_option_actor_port_prio_set, 495 502 }, 496 503 [BOND_OPT_AD_ACTOR_SYSTEM] = {