Re: [PATCH net] net: bonding: fix possible NULL deref in rlb code

From: Jay Vosburgh <jay.vosburgh@canonical.com>
To: Eric Dumazet <edumazet@google.com>
Cc: "David S . Miller" <davem@davemloft.net>,
	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	netdev@vger.kernel.org, eric.dumazet@gmail.com,
	syzbot <syzkaller@googlegroups.com>,
	Veaceslav Falico <vfalico@gmail.com>,
	Andy Gospodarek <andy@greyhouse.net>
Subject: Re: [PATCH net] net: bonding: fix possible NULL deref in rlb code
Date: Mon, 27 Jun 2022 10:30:11 -0700	[thread overview]
Message-ID: <19683.1656351011@famine> (raw)
In-Reply-To: <20220627102813.126264-1-edumazet@google.com>

Eric Dumazet <edumazet@google.com> wrote:

>syzbot has two reports involving the same root cause.
>
>bond_alb_initialize() must not set bond->alb_info.rlb_enabled
>if a memory allocation error is detected.
>
[...]
>
>Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
>Reported-by: syzbot <syzkaller@googlegroups.com>
>Signed-off-by: Eric Dumazet <edumazet@google.com>
>Cc: Jay Vosburgh <j.vosburgh@gmail.com>
>Cc: Veaceslav Falico <vfalico@gmail.com>
>Cc: Andy Gospodarek <andy@greyhouse.net>

Acked-by: Jay Vosburgh <jay.vosburgh@canonical.com>

>---
> drivers/net/bonding/bond_alb.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
>index 303c8d32d451e24345222ec105a1986d53a94eb4..007d43e46dcb0cb1cee1f23623bd161a6c32a45c 100644
>--- a/drivers/net/bonding/bond_alb.c
>+++ b/drivers/net/bonding/bond_alb.c
>@@ -1302,12 +1302,12 @@ int bond_alb_initialize(struct bonding *bond, int rlb_enabled)
> 		return res;
> 
> 	if (rlb_enabled) {
>-		bond->alb_info.rlb_enabled = 1;
> 		res = rlb_initialize(bond);
> 		if (res) {
> 			tlb_deinitialize(bond);
> 			return res;
> 		}
>+		bond->alb_info.rlb_enabled = 1;
> 	} else {
> 		bond->alb_info.rlb_enabled = 0;
> 	}
>-- 
>2.37.0.rc0.161.g10f37bed90-goog
>