[PATCH 0/2] bonding: 3ad: fix 2 RCU issues in ad_mux_machine()

[PATCH 0/2] bonding: 3ad: fix 2 RCU issues in ad_mux_machine()

[Hangbin Liu]

This series addresses a NULL pointer dereference in ad_mux_machine()
when ad_port_selection_logic() detaches a port from its aggregator
but does not assign a replacement.

Patch 1 adds an early null aggregator check in ad_mux_machine() to
prevent the oops. Patch 2 is a minor RCU fix that uses RCU_INIT_POINTER()
when initializing port->aggregator to NULL.

Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
Hangbin Liu (2):
      bonding: 3ad: fix NULL pointer dereference in ad_mux_machine()
      bonding: 3ad: use RCU_INIT_POINTER for rcu pointer initialization

 drivers/net/bonding/bond_3ad.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
---
base-commit: 44871eadd07a7f004aa00cb87399461eea08c630
change-id: 20260806-bond_rcu-5d99f64547b7

Best regards,
-- 
Hangbin Liu <liuhangbin@kylinos.cn>

[PATCH 1/2] bonding: 3ad: fix NULL pointer dereference in ad_mux_machine()

[Hangbin Liu]

From: Hangbin Liu <liuhangbin@kylinos.cn>

In bond_3ad_state_machine_handler(), ad_port_selection_logic() runs
before ad_mux_machine() for each port. When ad_port_selection_logic()
detaches a port from its current aggregator but fails to find a
suitable replacement, it returns early, leaving port->aggregator as
NULL. The subsequent call to ad_mux_machine() then dereferences the
NULL aggregator in multiple switch branches, triggering a kernel oops.

Add a NULL check for the aggregator at the top of ad_mux_machine() and
return early. This avoids needing null guards in later branches.

Detected by AI code review.

Fixes: c4f050ce06c5 ("bonding: 3ad: implement proper RCU rules for port->aggregator")
Cc: stable@vger.kernel.org
Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
 drivers/net/bonding/bond_3ad.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index acbba08dbdfa..196830fca4a4 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -1053,6 +1053,9 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr)
 	last_state = port->sm_mux_state;
 
 	aggregator = rcu_dereference(port->aggregator);
+	if (!aggregator)
+		return;
+
 	if (port->sm_vars & AD_PORT_BEGIN) {
 		port->sm_mux_state = AD_MUX_DETACHED;
 	} else {

-- 
2.55.0

[PATCH 2/2] bonding: 3ad: use RCU_INIT_POINTER for rcu pointer initialization

[Hangbin Liu]

From: Hangbin Liu <liuhangbin@kylinos.cn>

Use RCU_INIT_POINTER() for initializing port->aggregator to NULL.

Fixes: c4f050ce06c5 ("bonding: 3ad: implement proper RCU rules for port->aggregator")
Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
 drivers/net/bonding/bond_3ad.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 196830fca4a4..c4dfcafcff26 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2075,7 +2075,7 @@ static void ad_initialize_port(struct port *port, const struct bond_params *bond
 		port->sm_mux_state = 0;
 		port->sm_mux_timer_counter = 0;
 		port->sm_tx_state = 0;
-		port->aggregator = NULL;
+		RCU_INIT_POINTER(port->aggregator, NULL);
 		port->next_port_in_aggregator = NULL;
 		port->transaction_id = 0;
 

-- 
2.55.0

Re: [PATCH 2/2] bonding: 3ad: use RCU_INIT_POINTER for rcu pointer initialization

[Eric Dumazet]

On Mon, Aug 17, 2026 at 10:33 AM Hangbin Liu <hangbin.liu@linux.dev> wrote:
>
> From: Hangbin Liu <liuhangbin@kylinos.cn>
>
> Use RCU_INIT_POINTER() for initializing port->aggregator to NULL.
>
> Fixes: c4f050ce06c5 ("bonding: 3ad: implement proper RCU rules for port->aggregator")
> Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
> ---
>  drivers/net/bonding/bond_3ad.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
> index 196830fca4a4..c4dfcafcff26 100644
> --- a/drivers/net/bonding/bond_3ad.c
> +++ b/drivers/net/bonding/bond_3ad.c
> @@ -2075,7 +2075,7 @@ static void ad_initialize_port(struct port *port, const struct bond_params *bond
>                 port->sm_mux_state = 0;
>                 port->sm_mux_timer_counter = 0;
>                 port->sm_tx_state = 0;
> -               port->aggregator = NULL;
> +               RCU_INIT_POINTER(port->aggregator, NULL);
>                 port->next_port_in_aggregator = NULL;
>                 port->transaction_id = 0;
>

This is a NOP really, the object is not visible yet.

pw-bot: cr

Re: [PATCH 2/2] bonding: 3ad: use RCU_INIT_POINTER for rcu pointer initialization

[Hangbin Liu]

On Mon, Aug 17, 2026 at 10:37:56AM +0200, Eric Dumazet wrote:
> On Mon, Aug 17, 2026 at 10:33 AM Hangbin Liu <hangbin.liu@linux.dev> wrote:
> >
> > From: Hangbin Liu <liuhangbin@kylinos.cn>
> >
> > Use RCU_INIT_POINTER() for initializing port->aggregator to NULL.
> >
> > Fixes: c4f050ce06c5 ("bonding: 3ad: implement proper RCU rules for port->aggregator")
> > Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
> > ---
> >  drivers/net/bonding/bond_3ad.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
> > index 196830fca4a4..c4dfcafcff26 100644
> > --- a/drivers/net/bonding/bond_3ad.c
> > +++ b/drivers/net/bonding/bond_3ad.c
> > @@ -2075,7 +2075,7 @@ static void ad_initialize_port(struct port *port, const struct bond_params *bond
> >                 port->sm_mux_state = 0;
> >                 port->sm_mux_timer_counter = 0;
> >                 port->sm_tx_state = 0;
> > -               port->aggregator = NULL;
> > +               RCU_INIT_POINTER(port->aggregator, NULL);
> >                 port->next_port_in_aggregator = NULL;
> >                 port->transaction_id = 0;
> >
> 
> This is a NOP really, the object is not visible yet.

OH, I see. Sorry for bothering you.

Hangbin