diff options
| author | Eric Dumazet <edumazet@google.com> | 2026-03-15 10:41:52 +0000 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-03-16 19:29:45 -0700 |
| commit | b7405dcf7385445e10821777143f18c3ce20fa04 (patch) | |
| tree | 3eb6579409018c3cd699b6c521201a4e6dfb5d7d /net/phonet | |
| parent | 43d222fbcdff9a715dbe63a0c9e5902f1c9ddd10 (diff) | |
| download | linux-next-b7405dcf7385445e10821777143f18c3ce20fa04.tar.gz linux-next-b7405dcf7385445e10821777143f18c3ce20fa04.zip | |
bonding: prevent potential infinite loop in bond_header_parse()
bond_header_parse() can loop if a stack of two bonding devices is setup,
because skb->dev always points to the hierarchy top.
Add new "const struct net_device *dev" parameter to
(struct header_ops)->parse() method to make sure the recursion
is bounded, and that the final leaf parse method is called.
Fixes: 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Tested-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Cc: Jay Vosburgh <jv@jvosburgh.net>
Cc: Andrew Lunn <andrew+netdev@lunn.ch>
Link: https://patch.msgid.link/20260315104152.1436867-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net/phonet')
| -rw-r--r-- | net/phonet/af_phonet.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c index 238a9638d2b0..d89225d6bfd3 100644 --- a/net/phonet/af_phonet.c +++ b/net/phonet/af_phonet.c @@ -129,9 +129,12 @@ static int pn_header_create(struct sk_buff *skb, struct net_device *dev, return 1; } -static int pn_header_parse(const struct sk_buff *skb, unsigned char *haddr) +static int pn_header_parse(const struct sk_buff *skb, + const struct net_device *dev, + unsigned char *haddr) { const u8 *media = skb_mac_header(skb); + *haddr = *media; return 1; } |