Commit 067bf016 authored by Hangbin Liu's avatar Hangbin Liu Committed by Jakub Kicinski
Browse files

bonding: fix NULL pointer dereference in actor_port_prio setting 



Liang reported an issue where setting a slave’s actor_port_prio to
predefined values such as 0, 255, or 65535 would cause a system crash.

The problem occurs because in bond_opt_parse(), when the provided value
matches a predefined table entry, the function returns that table entry,
which does not contain slave information. Later, in
bond_option_actor_port_prio_set(), calling bond_slave_get_rtnl() leads
to a NULL pointer dereference.

Since actor_port_prio is defined as a u16 and initialized to the default
value of 255 in ad_initialize_port(), there is no need for the
bond_actor_port_prio_tbl. Using the BOND_OPTFLAG_RAWVAL flag is sufficient.

Fixes: 6b6dc81e ("bonding: add support for per-port LACP actor priority")
Reported-by: default avatarLiang Li <liali@redhat.com>
Signed-off-by: default avatarHangbin Liu <liuhangbin@gmail.com>
Link: https://patch.msgid.link/20251105072620.164841-1-liuhangbin@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 96baf482

drivers/net/bonding/bond_options.c

+1 −8
Original line number Diff line number Diff line
@@ -225,13 +225,6 @@ static const struct bond_opt_value bond_ad_actor_sys_prio_tbl[] = { 
	{ NULL,      -1,    0},

};



static const struct bond_opt_value bond_actor_port_prio_tbl[] = {

	{ "minval",  0,     BOND_VALFLAG_MIN},

	{ "maxval",  65535, BOND_VALFLAG_MAX},

	{ "default", 255,   BOND_VALFLAG_DEFAULT},

	{ NULL,      -1,    0},

};



static const struct bond_opt_value bond_ad_user_port_key_tbl[] = {

	{ "minval",  0,     BOND_VALFLAG_MIN | BOND_VALFLAG_DEFAULT},

	{ "maxval",  1023,  BOND_VALFLAG_MAX},
@@ -497,7 +490,7 @@ static const struct bond_option bond_opts[BOND_OPT_LAST] = { 
		.id = BOND_OPT_ACTOR_PORT_PRIO,

		.name = "actor_port_prio",

		.unsuppmodes = BOND_MODE_ALL_EX(BIT(BOND_MODE_8023AD)),

		.values = bond_actor_port_prio_tbl,

		.flags = BOND_OPTFLAG_RAWVAL,

		.set = bond_option_actor_port_prio_set,

	},

	[BOND_OPT_AD_ACTOR_SYSTEM] = {