Re: [PATCH bpf v1 1/2] net/bpf: fix null-ptr-deref in xdp_master_redirect() for bonding
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date: 2026-02-26 09:59:03
Also in:
bpf, linux-kselftest, linux-rt-devel, lkml
On 2026-02-24 19:25:41 [+0800], Jiayuan Chen wrote:
quoted hunk ↗ jump to hunk
--- a/net/core/filter.c +++ b/net/core/filter.c@@ -4387,6 +4387,9 @@ u32 xdp_master_redirect(struct xdp_buff *xdp) struct net_device *master, *slave; master = netdev_master_upper_dev_get_rcu(xdp->rxq->dev); + if (unlikely(!master || !netif_running(master))) + return XDP_TX; +
I'm not sure this check belongs here as this is not bond specific, is it? Also nothing stops the admin to put the device right after the netif_running() check so it fails later but the race window is not as wide as it is now. The per-CPU memory could be allocated while the bond device is created. I don't think delaying it until "device up" brings any advantages. One creates the device with the intention to use it so the "up" is inevitable. The bond_xmit_get_slave() callback has the same logic. Couldn't this scenario also occur to the ->ndo_get_xmit_slave() user?
slave = master->netdev_ops->ndo_xdp_get_xmit_slave(master, xdp);
if (slave && slave != xdp->rxq->dev) {
/* The target device is different from the receiving device, soSebastian