drivers/net/bonding/bond_main.c | 67 ++++++++++++++++++++++++++++++++- include/linux/netdevice.h | 41 ++++++++++++++------ include/net/bonding.h | 5 +++ include/net/cfg802154.h | 2 +- net/core/neighbour.c | 6 +-- net/ipv4/arp.c | 2 +- net/ipv6/ndisc.c | 2 +- 7 files changed, 106 insertions(+), 19 deletions(-)
In bond_setup_by_slave(), the slave’s header_ops are unconditionally
copied into the bonding device. As a result, the bonding device may invoke
the slave-specific header operations on itself, causing
netdev_priv(bond_dev) (a struct bonding) to be incorrectly interpreted
as the slave's private-data type.
This type-confusion bug can lead to out-of-bounds writes into the skb,
resulting in memory corruption.
Patch 1 stores the slave's header_ops in struct bonding and sets
wrapper callbacks in bond_In bond_setup_by_slave(), the slave’s
header_ops are unconditionally
copied into the bonding device. As a result, the bonding device may invoke
the slave-specific header operations on itself, causing
netdev_priv(bond_dev) (a struct bonding) to be incorrectly interpreted
as the slave's private-data type.
Patch 2 uses READ_ONCE when loading header_ops callbacks
to avoid races with concurrent updates.
Fixes: 1284cd3a2b74 ("bonding: two small fixes for IPoIB support")
Signed-off-by: Kota Toda <kota.toda@gmo-cybersecurity.com>
Co-developed-by: Yuki Koike <yuki.koike@gmo-cybersecurity.com>
Signed-off-by: Yuki Koike <yuki.koike@gmo-cybersecurity.com>
Kota Toda (2):
net: bonding: fix type-confusion in bonding header_ops
net: add READ_ONCE for header_ops callbacks
drivers/net/bonding/bond_main.c | 67 ++++++++++++++++++++++++++++++++-
include/linux/netdevice.h | 41 ++++++++++++++------
include/net/bonding.h | 5 +++
include/net/cfg802154.h | 2 +-
net/core/neighbour.c | 6 +--
net/ipv4/arp.c | 2 +-
net/ipv6/ndisc.c | 2 +-
7 files changed, 106 insertions(+), 19 deletions(-)
--
2.53.0
Kota Toda <kota.toda@gmo-cybersecurity.com> wrote:
>In bond_setup_by_slave(), the slave’s header_ops are unconditionally
>copied into the bonding device. As a result, the bonding device may invoke
>the slave-specific header operations on itself, causing
>netdev_priv(bond_dev) (a struct bonding) to be incorrectly interpreted
>as the slave's private-data type.
>
>This type-confusion bug can lead to out-of-bounds writes into the skb,
>resulting in memory corruption.
A few days ago, Jiayuan Chen <jiayuan.chen@linux.dev> posted a
fix for what sounds like the same problem[0]. Their solution appears to
be much less complicated.
I also wonder how this bug was discovered. The code in question
hasn't changed in many years, and now there are two independent fixes
within a week.
[0] https://lore.kernel.org/netdev/20260228095854.391093-1-jiayuan.chen@linux.dev/
>Patch 1 stores the slave's header_ops in struct bonding and sets
>wrapper callbacks in bond_In bond_setup_by_slave(), the slave’s
>header_ops are unconditionally
>copied into the bonding device. As a result, the bonding device may invoke
>the slave-specific header operations on itself, causing
>netdev_priv(bond_dev) (a struct bonding) to be incorrectly interpreted
>as the slave's private-data type.
>
>Patch 2 uses READ_ONCE when loading header_ops callbacks
>to avoid races with concurrent updates.
With the READ_ONCE changes in a separate patch, does that mean
that patch 1 by itself is subject to race conditions that would result
in errors? If so, that's not acceptable, every patch must stand alone
and not break the kernel.
-J
>Fixes: 1284cd3a2b74 ("bonding: two small fixes for IPoIB support")
>Signed-off-by: Kota Toda <kota.toda@gmo-cybersecurity.com>
>Co-developed-by: Yuki Koike <yuki.koike@gmo-cybersecurity.com>
>Signed-off-by: Yuki Koike <yuki.koike@gmo-cybersecurity.com>
>
>Kota Toda (2):
> net: bonding: fix type-confusion in bonding header_ops
> net: add READ_ONCE for header_ops callbacks
>
> drivers/net/bonding/bond_main.c | 67 ++++++++++++++++++++++++++++++++-
> include/linux/netdevice.h | 41 ++++++++++++++------
> include/net/bonding.h | 5 +++
> include/net/cfg802154.h | 2 +-
> net/core/neighbour.c | 6 +--
> net/ipv4/arp.c | 2 +-
> net/ipv6/ndisc.c | 2 +-
> 7 files changed, 106 insertions(+), 19 deletions(-)
>
>--
>2.53.0
>
>
---
-Jay Vosburgh, jv@jvosburgh.net
Thank you for your quick response.
I was not aware that such a patch had already been posted and got
approved. That patch looks like a good approach to me.
Given that, I am happy to withdraw my patch.
> I also wonder how this bug was discovered. The code in question
> hasn't changed in many years, and now there are two independent fixes
> within a week.
I found this bug through kernel fuzzing.
2026年3月6日(金) 5:59 Jay Vosburgh <jv@jvosburgh.net>:
>
> Kota Toda <kota.toda@gmo-cybersecurity.com> wrote:
>
> >In bond_setup_by_slave(), the slave’s header_ops are unconditionally
> >copied into the bonding device. As a result, the bonding device may invoke
> >the slave-specific header operations on itself, causing
> >netdev_priv(bond_dev) (a struct bonding) to be incorrectly interpreted
> >as the slave's private-data type.
> >
> >This type-confusion bug can lead to out-of-bounds writes into the skb,
> >resulting in memory corruption.
>
> A few days ago, Jiayuan Chen <jiayuan.chen@linux.dev> posted a
> fix for what sounds like the same problem[0]. Their solution appears to
> be much less complicated.
>
> I also wonder how this bug was discovered. The code in question
> hasn't changed in many years, and now there are two independent fixes
> within a week.
>
> [0] https://lore.kernel.org/netdev/20260228095854.391093-1-jiayuan.chen@linux.dev/
>
> >Patch 1 stores the slave's header_ops in struct bonding and sets
> >wrapper callbacks in bond_In bond_setup_by_slave(), the slave’s
> >header_ops are unconditionally
> >copied into the bonding device. As a result, the bonding device may invoke
> >the slave-specific header operations on itself, causing
> >netdev_priv(bond_dev) (a struct bonding) to be incorrectly interpreted
> >as the slave's private-data type.
> >
> >Patch 2 uses READ_ONCE when loading header_ops callbacks
> >to avoid races with concurrent updates.
>
> With the READ_ONCE changes in a separate patch, does that mean
> that patch 1 by itself is subject to race conditions that would result
> in errors? If so, that's not acceptable, every patch must stand alone
> and not break the kernel.
>
> -J
>
> >Fixes: 1284cd3a2b74 ("bonding: two small fixes for IPoIB support")
> >Signed-off-by: Kota Toda <kota.toda@gmo-cybersecurity.com>
> >Co-developed-by: Yuki Koike <yuki.koike@gmo-cybersecurity.com>
> >Signed-off-by: Yuki Koike <yuki.koike@gmo-cybersecurity.com>
> >
> >Kota Toda (2):
> > net: bonding: fix type-confusion in bonding header_ops
> > net: add READ_ONCE for header_ops callbacks
> >
> > drivers/net/bonding/bond_main.c | 67 ++++++++++++++++++++++++++++++++-
> > include/linux/netdevice.h | 41 ++++++++++++++------
> > include/net/bonding.h | 5 +++
> > include/net/cfg802154.h | 2 +-
> > net/core/neighbour.c | 6 +--
> > net/ipv4/arp.c | 2 +-
> > net/ipv6/ndisc.c | 2 +-
> > 7 files changed, 106 insertions(+), 19 deletions(-)
> >
> >--
> >2.53.0
> >
> >
>
> ---
> -Jay Vosburgh, jv@jvosburgh.net
>
March 6, 2026 at 04:59, "Jay Vosburgh" <jv@jvosburgh.net mailto:jv@jvosburgh.net?to=%22Jay%20Vosburgh%22%20%3Cjv%40jvosburgh.net%3E > wrote:
>
> Kota Toda <kota.toda@gmo-cybersecurity.com> wrote:
>
> >
> > In bond_setup_by_slave(), the slave’s header_ops are unconditionally
> > copied into the bonding device. As a result, the bonding device may invoke
> > the slave-specific header operations on itself, causing
> > netdev_priv(bond_dev) (a struct bonding) to be incorrectly interpreted
> > as the slave's private-data type.
> >
> > This type-confusion bug can lead to out-of-bounds writes into the skb,
> > resulting in memory corruption.
> >
> A few days ago, Jiayuan Chen <jiayuan.chen@linux.dev> posted a
> fix for what sounds like the same problem[0]. Their solution appears to
> be much less complicated.
>
> I also wonder how this bug was discovered. The code in question
> hasn't changed in many years, and now there are two independent fixes
> within a week.
This issue has existed for years, but was likely masked by other bugs in the IP GRE
module.
https://syzkaller.appspot.com/bug?extid=4c63f36709a642f801c5
https://syzkaller.appspot.com/bug?id=77135d6c2fc52eff1b3c561912fbec39761e0461
The recent commit e67c577d8989 ("ipv4: ip_gre: make ipgre_header() robust"), which
introduced pskb_expand_head, has made the wrong type-casting issue more apparent.
v2 was sent:
https://lore.kernel.org/netdev/20260306021508.222062-1-jiayuan.chen@linux.dev/
> [0] https://lore.kernel.org/netdev/20260228095854.391093-1-jiayuan.chen@linux.dev/
>
> >
> > Patch 1 stores the slave's header_ops in struct bonding and sets
> > wrapper callbacks in bond_In bond_setup_by_slave(), the slave’s
> > header_ops are unconditionally
> > copied into the bonding device. As a result, the bonding device may invoke
> > the slave-specific header operations on itself, causing
> > netdev_priv(bond_dev) (a struct bonding) to be incorrectly interpreted
> > as the slave's private-data type.
> >
> > Patch 2 uses READ_ONCE when loading header_ops callbacks
> > to avoid races with concurrent updates.
> >
> With the READ_ONCE changes in a separate patch, does that mean
> that patch 1 by itself is subject to race conditions that would result
> in errors? If so, that's not acceptable, every patch must stand alone
> and not break the kernel.
>
> -J
>
> >
> > Fixes: 1284cd3a2b74 ("bonding: two small fixes for IPoIB support")
> > Signed-off-by: Kota Toda <kota.toda@gmo-cybersecurity.com>
> > Co-developed-by: Yuki Koike <yuki.koike@gmo-cybersecurity.com>
> > Signed-off-by: Yuki Koike <yuki.koike@gmo-cybersecurity.com>
> >
> > Kota Toda (2):
> > net: bonding: fix type-confusion in bonding header_ops
> > net: add READ_ONCE for header_ops callbacks
> >
> > drivers/net/bonding/bond_main.c | 67 ++++++++++++++++++++++++++++++++-
> > include/linux/netdevice.h | 41 ++++++++++++++------
> > include/net/bonding.h | 5 +++
> > include/net/cfg802154.h | 2 +-
> > net/core/neighbour.c | 6 +--
> > net/ipv4/arp.c | 2 +-
> > net/ipv6/ndisc.c | 2 +-
> > 7 files changed, 106 insertions(+), 19 deletions(-)
> >
> > --
> > 2.53.0
> >
> ---
> -Jay Vosburgh, jv@jvosburgh.net
>
March 6, 2026 at 04:59, "Jay Vosburgh" <jv@jvosburgh.net mailto:jv@jvosburgh.net?to=%22Jay%20Vosburgh%22%20%3Cjv%40jvosburgh.net%3E > wrote:
>
> Kota Toda <kota.toda@gmo-cybersecurity.com> wrote:
>
> >
> > In bond_setup_by_slave(), the slave’s header_ops are unconditionally
> > copied into the bonding device. As a result, the bonding device may invoke
> > the slave-specific header operations on itself, causing
> > netdev_priv(bond_dev) (a struct bonding) to be incorrectly interpreted
> > as the slave's private-data type.
> >
> > This type-confusion bug can lead to out-of-bounds writes into the skb,
> > resulting in memory corruption.
> >
> A few days ago, Jiayuan Chen <jiayuan.chen@linux.dev> posted a
> fix for what sounds like the same problem[0]. Their solution appears to
> be much less complicated.
>
> I also wonder how this bug was discovered. The code in question
> hasn't changed in many years, and now there are two independent fixes
> within a week.
This issue has existed for years, but was likely masked by other bugs in the IP GRE
module.
https://syzkaller.appspot.com/bug?extid=4c63f36709a642f801c5
https://syzkaller.appspot.com/bug?id=77135d6c2fc52eff1b3c561912fbec39761e0461
The recent commit e67c577d8989 ("ipv4: ip_gre: make ipgre_header() robust"), which
introduced pskb_expand_head, has made the wrong type-casting issue more apparent.
v2 was sent:
https://lore.kernel.org/netdev/20260306021508.222062-1-jiayuan.chen@linux.dev/
> [0] https://lore.kernel.org/netdev/20260228095854.391093-1-jiayuan.chen@linux.dev/
>
> >
> > Patch 1 stores the slave's header_ops in struct bonding and sets
> > wrapper callbacks in bond_In bond_setup_by_slave(), the slave’s
> > header_ops are unconditionally
> > copied into the bonding device. As a result, the bonding device may invoke
> > the slave-specific header operations on itself, causing
> > netdev_priv(bond_dev) (a struct bonding) to be incorrectly interpreted
> > as the slave's private-data type.
> >
> > Patch 2 uses READ_ONCE when loading header_ops callbacks
> > to avoid races with concurrent updates.
> >
> With the READ_ONCE changes in a separate patch, does that mean
> that patch 1 by itself is subject to race conditions that would result
> in errors? If so, that's not acceptable, every patch must stand alone
> and not break the kernel.
>
> -J
>
> >
> > Fixes: 1284cd3a2b74 ("bonding: two small fixes for IPoIB support")
> > Signed-off-by: Kota Toda <kota.toda@gmo-cybersecurity.com>
> > Co-developed-by: Yuki Koike <yuki.koike@gmo-cybersecurity.com>
> > Signed-off-by: Yuki Koike <yuki.koike@gmo-cybersecurity.com>
> >
> > Kota Toda (2):
> > net: bonding: fix type-confusion in bonding header_ops
> > net: add READ_ONCE for header_ops callbacks
> >
> > drivers/net/bonding/bond_main.c | 67 ++++++++++++++++++++++++++++++++-
> > include/linux/netdevice.h | 41 ++++++++++++++------
> > include/net/bonding.h | 5 +++
> > include/net/cfg802154.h | 2 +-
> > net/core/neighbour.c | 6 +--
> > net/ipv4/arp.c | 2 +-
> > net/ipv6/ndisc.c | 2 +-
> > 7 files changed, 106 insertions(+), 19 deletions(-)
> >
> > --
> > 2.53.0
> >
> ---
> -Jay Vosburgh, jv@jvosburgh.net
>
© 2016 - 2026 Red Hat, Inc.