[PATCH] bonding: reject IEEE 802.15.4 and 6LoWPAN devices in bond_enslave

[Kalpesh Solanki <skalpesh942@gmail.com>]

When the first non-Ethernet slave is enslaved to a bond,
bond_setup_by_slave() copies slave_dev->type to the bond device.
However, the bonding driver does not set up subsystem-specific
mid-layer contexts or private structures:

1. IEEE 802.15.4 routines (such as ieee802154_llsec_dump_table(),
   nl-phy.c, and socket callbacks) identify WPAN devices by dev->type
   alone and unconditionally dereference dev->ieee802154_ptr and
   dev->ml_priv (ieee802154_mlme_ops). Because bonding never allocates
   these, this results in a NULL pointer dereference.

2. The 6LoWPAN netdevice notifier (lowpan_event()) identifies devices
   by dev->type == ARPHRD_6LOWPAN and treats netdev_priv(dev) as
   struct lowpan_dev. On a bond master, netdev_priv() is struct bonding,
   so writes to lowpan_dev(dev)->ctx.table flags on events like
   NETDEV_DOWN corrupt the bonding driver's private state.

The team driver closed an identical gap in commit 9043be310c6a ("team:
reject CAN, IEEE 802.15.4 and 6LoWPAN devices in team_port_add"). Bonding
previously only blocked CAN devices in commit 8ba68464e478 ("bonding:
refuse to enslave CAN devices").

Reject ARPHRD_IEEE802154, ARPHRD_IEEE802154_MONITOR, and ARPHRD_6LOWPAN
devices in bond_enslave().

Fixes: 8ba68464e478 ("bonding: refuse to enslave CAN devices")
Signed-off-by: Kalpesh Solanki <skalpesh942@gmail.com>
---
 drivers/net/bonding/bond_main.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 7019e5d8fdc..b3b003e39b2 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1894,9 +1894,12 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
 	struct sockaddr_storage ss;
 	int res = 0, i;
 
-	if (slave_dev->type == ARPHRD_CAN) {
+	if (slave_dev->type == ARPHRD_CAN ||
+	    slave_dev->type == ARPHRD_IEEE802154 ||
+	    slave_dev->type == ARPHRD_IEEE802154_MONITOR ||
+	    slave_dev->type == ARPHRD_6LOWPAN) {
 		BOND_NL_ERR(bond_dev, extack,
-			    "CAN devices cannot be enslaved");
+			    "CAN, IEEE 802.15.4 and 6LoWPAN devices cannot be enslaved");
 		return -EPERM;
 	}
 
-- 
2.53.0