Re: [PATCH net v3] net: bonding: fix use-after-free in bond_xmit_broadcast()
From: Paolo Abeni <pabeni@redhat.com>
Date: 2026-03-31 08:53:18
On 3/26/26 8:55 AM, Xiang Mei wrote:
quoted hunk ↗ jump to hunk
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index 33f414d03ab91..a5484d11553d1 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c@@ -5326,7 +5326,7 @@ static netdev_tx_t bond_xmit_broadcast(struct sk_buff *skb, if (!(bond_slave_is_up(slave) && slave->link == BOND_LINK_UP)) continue; - if (bond_is_last_slave(bond, slave)) { + if (i + 1 == slaves_count) { skb2 = skb; skb_used = true; } else {
The above removes the last usage of the bond_is_last_slave() helper, which in turn could/should be removed, too. To avoid delaying this patch too much I'm applying it as is, but please follow-up on net-next removing the stray helper after this patch will land there (i.e. after Thursday). Thanks, Paolo