From nobody Sat Jul 25 03:20:49 2026 Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F09D937FF4E for ; Sun, 19 Jul 2026 23:21:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784503319; cv=none; b=aOIvoI/HXr5u7gRC5rqmp4Z7/oy3pRW90l2d80CdApmOqhO1Qc/bl/NacfAqi/uPUnCmZa6HqjcAiuddulCp+be3PceKpnL/0fqIRsIWSGRQW+BgN5r+2fbeqZeWuX+XzLI1ehDKws26/GIxmSww2kV6pMufPVneTcjrc9VCRPI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784503319; c=relaxed/simple; bh=hXLBiA56AtYJu6PvYneevXPNAEmjC0iHDLtyWlRyexE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=A/58fxqOyGYVtwrzv1HRIZGXDbz0JgqXVg6gN82JEgfAlDf+yU9P09YP1Zzx6xgJaJP0ytQYFjfG5FBbPDeCyZa5giA4XNlxvOyR/gZRCb4lg+JwT8jPy7kIeiIWjsB30sC0+Eymxwsd6jV/tN7Uv0q+srjHRu7/vncZ7FTueLU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu; spf=pass smtp.mailfrom=asu.edu; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b=aqPmmtal; arc=none smtp.client-ip=209.85.214.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=asu.edu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b="aqPmmtal" Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2cc891373e0so115705315ad.2 for ; Sun, 19 Jul 2026 16:21:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=asu.edu; s=google; t=1784503316; x=1785108116; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=/y8P5MwGMN985NJk2E4j0Ig7gSOteCnsYHCJe1HX2eQ=; b=aqPmmtallT7rhlYHP1wYFJ2Y0cvt9DPA/INvq5O/UlPbjSDQ3fbO5SEPz4ASrurAz8 g5vuV5wBWOnHwqJalaEDxIMpbLQSGgOas5iBjQn6OucLcxuhXtEYN5xKZ7KtTmMPcSAN mdyJ/Dxb/r2w0BeJVrDLvUgTN6iH8KAUA3oaN0E6ZH5pgC7MtBfznudTiDXSN4FrJww0 uTkhRdDBEQg883VhgrUnUTemGRLjGXcPX9loDsIWfj3XOegTqbohME2DQ2iZLdlosDo5 hvw9Ych/mOcKYsAfLTXzPT5iI3eCHQ2MWhswEoaWrSp8M+60JmryRZ2Yu88spvp4Q5En q8kA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784503316; x=1785108116; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=/y8P5MwGMN985NJk2E4j0Ig7gSOteCnsYHCJe1HX2eQ=; b=JKU2n3CiE/wsmPysenwpCkmJATZ5De1UuF9qsqAjjmKUYgIVHgMknT4p/LTQxviPZU v88p+VOwC4mKxdpOAybrESyzYScRH46/M1rX2DjA8fpocTct9XMPh81NDeExnuFmLjnX 3HJUa17fmcZPBl/Kr1gB26RA9RC5bV9yV16RnT3txaoWMwNhbhfT4WbdlW+E3lCn2cUg w6K0GbMWIVNCZAn30CdhxALoT94hLwKU/RvPr082ZbRvxAF28/QuMpyEcJ+ReNDGyAdH b+Go7xI5F88hlnraQ2OJgrm1jTG0BmfqihAnmHrJzNHj1Bh01mDWVNNh8I43ZoxQlwks iIsw== X-Forwarded-Encrypted: i=1; AHgh+Ro/gsh5zx+HXOShEYeCUDCUPEpSokhKX3Q1d/Bl6JQ9IVijryFmP42dCPui2ynwQLssP6fQZoK44i9Qw/8=@vger.kernel.org X-Gm-Message-State: AOJu0YxNbZn918lpJUy0tOe4ewJfsR14aZvxCBwdIqZhEQMkpsFRbC/K bYm3Co/JfIAOUFq+wUPfp9dvBCzeo8OvSr7RTZAW+O/g5PcYNjd8gWKffTDA5HF2ug== X-Gm-Gg: AfdE7cmVg+rmI3SQjmnJlRR+iHSzQaiAl+9PP70RbPOlN8lvQjxGUb9nMPhXL6kEQH0 KK6p0wnr/3NTa/uHQJ3+HseWxJZwOmbmliuu74iuxTaGLq2hrHDC2QJvnCQpe4N3bqxbcK9LIqA YDiRMpa2Rb+5BbyGIy/U/t91CC26QtdCwgR047faS2z0lr4ZFgPAYr7fG2RVgzykP63gd0oevkF thqohWUqRsfK6t5IJf2DsKSLFPE9RCbi4vtoXoI3+dwDScnEjxtErP5YDokyIoRl7kLB75Dgh0J 3pfguWxdwOVKQA7FW6cCm3hS9hDYUhDqP1x5VOYz3mV4Ed0TtiXdCeDzXX9crxoOZxLphCnp1KH Pgs4jzaMGRZLA05UdNLp5GjfiiKiJBEytBFxQGb4iJ4rz9TwYmBCWJv822R6h7a40IwBaYQ5rO9 Uu/sNQr3E= X-Received: by 2002:a17:902:e54b:b0:2c9:b48c:fdec with SMTP id d9443c01a7336-2cf348547d0mr135063955ad.12.1784503316225; Sun, 19 Jul 2026 16:21:56 -0700 (PDT) Received: from xiang.tailc0aff1.ts.net ([20.171.14.70]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-31429fdbd45sm29720183eec.12.2026.07.19.16.21.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 19 Jul 2026 16:21:55 -0700 (PDT) From: "Xiang Mei (Microsoft)" To: Jay Vosburgh , Andrew Lunn , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni Cc: Hangbin Liu , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, AutonomousCodeSecurity@microsoft.com, tgopinath@linux.microsoft.com, kys@microsoft.com, "Xiang Mei (Microsoft)" Subject: [PATCH net] bonding: fix skb_under_panic in bond_ns_send() over stacked VLANs Date: Sun, 19 Jul 2026 23:21:53 +0000 Message-ID: <20260719232153.1405569-1-xmei5@asu.edu> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" bond_ns_send() builds an IPv6 Neighbor Solicitation with ndisc_ns_create(), which reserves exactly LL_RESERVED_SPACE(dev) + sizeof(struct ipv6hdr) of headroom for the later ip6_nd_hdr() push. bond_handle_vlan() then inserts the collected VLAN tags into the skb; each inner tag consumes VLAN_HLEN of that headroom via skb_push(). With enough stacked VLAN devices between the bond and the ns_ip6_target, the reserved IPv6 headroom is exhausted, so the subsequent ndisc_send_skb() -> ip6_nd_hdr() -> skb_push(sizeof(struct ipv6hdr)) underflows past skb->head and hits skb_under_panic(). Restore the required headroom with skb_cow_head() after VLAN insertion and before handing the skb to ndisc_send_skb(); drop the probe on allocation failure. For paths that did not exhaust the headroom this is a no-op, so previously working configurations are unaffected. skbuff: skb_under_panic: len:84 put:40 head:... data:... tail:0x50 end:0x= 180 dev:veth0 kernel BUG at net/core/skbuff.c:214! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI Workqueue: bond0 bond_arp_monitor RIP: 0010:skb_panic+0x142/0x230 Call Trace: skb_push (net/core/skbuff.c:224) ndisc_send_skb (net/ipv6/ndisc.c:454 net/ipv6/ndisc.c:506) bond_ns_send (drivers/net/bonding/bond_main.c:3255) bond_ns_send_all (drivers/net/bonding/bond_main.c:3313) bond_arp_monitor (drivers/net/bonding/bond_main.c:3458) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3405) kthread (kernel/kthread.c:436) Kernel panic - not syncing: Fatal exception Fixes: 4e24be018eb9 ("bonding: add new parameter ns_targets") Reported-by: AutonomousCodeSecurity@microsoft.com Signed-off-by: Xiang Mei (Microsoft) --- drivers/net/bonding/bond_main.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_mai= n.c index e044fc733b8c..3ac3418c9498 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -3251,6 +3251,10 @@ static void bond_ns_send(struct slave *slave, const = struct in6_addr *daddr, =20 addrconf_addr_solict_mult(daddr, &mcaddr); if (bond_handle_vlan(slave, tags, skb)) { + if (skb_cow_head(skb, sizeof(struct ipv6hdr))) { + kfree_skb(skb); + return; + } slave_update_last_tx(slave); ndisc_send_skb(skb, &mcaddr, saddr); } --=20 2.43.0