Re: [PATCH] bonding: reject IEEE 802.15.4 and 6LoWPAN devices in bond_enslave

[Oliver Hartkopp <socketcan@hartkopp.net>]

Hi Kalpesh,

many thanks for picking this up!

On 12.11.26 14:08, Kalpesh Solanki wrote:
> When the first non-Ethernet slave is enslaved to a bond,
> bond_setup_by_slave() copies slave_dev->type to the bond device.
> However, the bonding driver does not set up subsystem-specific
> mid-layer contexts or private structures:
> 
> 1. IEEE 802.15.4 routines (such as ieee802154_llsec_dump_table(),
>     nl-phy.c, and socket callbacks) identify WPAN devices by dev->type
>     alone and unconditionally dereference dev->ieee802154_ptr and
>     dev->ml_priv (ieee802154_mlme_ops). Because bonding never allocates
>     these, this results in a NULL pointer dereference.
> 
> 2. The 6LoWPAN netdevice notifier (lowpan_event()) identifies devices
>     by dev->type == ARPHRD_6LOWPAN and treats netdev_priv(dev) as
>     struct lowpan_dev. On a bond master, netdev_priv() is struct bonding,
>     so writes to lowpan_dev(dev)->ctx.table flags on events like
>     NETDEV_DOWN corrupt the bonding driver's private state.
> 
> The team driver closed an identical gap in commit 9043be310c6a ("team:
> reject CAN, IEEE 802.15.4 and 6LoWPAN devices in team_port_add"). Bonding
> previously only blocked CAN devices in commit 8ba68464e478 ("bonding:
> refuse to enslave CAN devices").

You could have referenced the bonding-splats from my patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9043be310c6a4c5e57f7bba4b9870554eac7aa96

So it is not only that this problem has been found by manual code 
inspection.

> Reject ARPHRD_IEEE802154, ARPHRD_IEEE802154_MONITOR, and ARPHRD_6LOWPAN
> devices in bond_enslave().
> 
> Fixes: 8ba68464e478 ("bonding: refuse to enslave CAN devices")
> Signed-off-by: Kalpesh Solanki <skalpesh942@gmail.com>

Reviewed-by: Oliver Hartkopp <socketcan@hartkopp.net>

Best regards,
Oliver

> ---
>   drivers/net/bonding/bond_main.c | 7 +++++--
>   1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
> index 7019e5d8fdc..b3b003e39b2 100644
> --- a/drivers/net/bonding/bond_main.c
> +++ b/drivers/net/bonding/bond_main.c
> @@ -1894,9 +1894,12 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
>   	struct sockaddr_storage ss;
>   	int res = 0, i;
>   
> -	if (slave_dev->type == ARPHRD_CAN) {
> +	if (slave_dev->type == ARPHRD_CAN ||
> +	    slave_dev->type == ARPHRD_IEEE802154 ||
> +	    slave_dev->type == ARPHRD_IEEE802154_MONITOR ||
> +	    slave_dev->type == ARPHRD_6LOWPAN) {
>   		BOND_NL_ERR(bond_dev, extack,
> -			    "CAN devices cannot be enslaved");
> +			    "CAN, IEEE 802.15.4 and 6LoWPAN devices cannot be enslaved");
>   		return -EPERM;
>   	}
>