[PATCH 1/2] bonding: 3ad: fix NULL pointer dereference in ad_mux_machine()
Hangbin Liu <[email protected]>
| Newsgroups | org.kernel.vger.stable,org.kernel.vger.linux-kernel,org.kernel.vger.netdev |
|---|---|
| Message-ID | <[email protected]> |
From: Hangbin Liu <[email protected]> In bond_3ad_state_machine_handler(), ad_port_selection_logic() runs before ad_mux_machine() for each port. When ad_port_selection_logic() detaches a port from its current aggregator but fails to find a suitable replacement, it returns early, leaving port->aggregator as NULL. The subsequent call to ad_mux_machine() then dereferences the NULL aggregator in multiple switch branches, triggering a kernel oops. Add a NULL check for the aggregator at the top of ad_mux_machine() and return early. This avoids needing null guards in later branches. Detected by AI code review. Fixes: c4f050ce06c5 ("bonding: 3ad: implement proper RCU rules for port->aggregator") Cc: [email protected] Signed-off-by: Hangbin Liu <[email protected]> --- drivers/net/bonding/bond_3ad.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c index acbba08dbdfa..196830fca4a4 100644 --- a/drivers/net/bonding/bond_3ad.c +++ b/drivers/net/bonding/bond_3ad.c @@ -1053,6 +1053,9 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) last_state = port->sm_mux_state; aggregator = rcu_dereference(port->aggregator); + if (!aggregator) + return; + if (port->sm_vars & AD_PORT_BEGIN) { port->sm_mux_state = AD_MUX_DETACHED; } else { -- 2.55.0