kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/drivers/net/bonding
History
Eric Dumazet b956289b83 bonding: annotate data-races around slave->last_rx 
[ Upstream commit f6c3665b6d ]

slave->last_rx and slave->target_last_arp_rx[...] can be read and written
locklessly. Add READ_ONCE() and WRITE_ONCE() annotations.

syzbot reported:

BUG: KCSAN: data-race in bond_rcv_validate / bond_rcv_validate

write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 1:
  bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335
  bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533
  __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039
  __netif_receive_skb_one_core net/core/dev.c:6150 [inline]
  __netif_receive_skb+0x59/0x270 net/core/dev.c:6265
  netif_receive_skb_internal net/core/dev.c:6351 [inline]
  netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410
...

write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 0:
  bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335
  bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533
  __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039
  __netif_receive_skb_one_core net/core/dev.c:6150 [inline]
  __netif_receive_skb+0x59/0x270 net/core/dev.c:6265
  netif_receive_skb_internal net/core/dev.c:6351 [inline]
  netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410
  br_netif_receive_skb net/bridge/br_input.c:30 [inline]
  NF_HOOK include/linux/netfilter.h:318 [inline]
...

value changed: 0x0000000100005365 -> 0x0000000100005366

Fixes: f5b2b966f0 ("[PATCH] bonding: Validate probe replies in ARP monitor")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Link: https://patch.msgid.link/20260122162914.2299312-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-02-06 16:55:41 +01:00
..
bond_3ad.c bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU 2025-08-28 16:31:15 +02:00
bond_alb.c bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk 2023-11-21 12:06:50 +01:00
bond_debugfs.c bonding: remove redundant NULL check in debugfs function 2023-08-11 11:10:55 +01:00
bond_main.c bonding: annotate data-races around slave->last_rx 2026-02-06 16:55:41 +01:00
bond_netlink.c bonding: no longer use RTNL in bonding_show_queue_id() 2024-04-09 17:31:45 -07:00
bond_options.c bonding: annotate data-races around slave->last_rx 2026-02-06 16:55:41 +01:00
bond_procfs.c bonding: no longer use RTNL in bonding_show_queue_id() 2024-04-09 17:31:45 -07:00
bond_sysfs.c bonding: no longer use RTNL in bonding_show_queue_id() 2024-04-09 17:31:45 -07:00
bond_sysfs_slave.c bonding: no longer use RTNL in bonding_show_queue_id() 2024-04-09 17:31:45 -07:00
bonding_priv.h net: bonding: Add SPDX identifier to remaining files 2023-05-16 15:38:06 +02:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00