bonding: fix NULL pointer dereference in actor_port_prio setting
authorHangbin Liu <liuhangbin@gmail.com>
Wed, 5 Nov 2025 07:26:20 +0000 (07:26 +0000)
committerJakub Kicinski <kuba@kernel.org>
Thu, 6 Nov 2025 15:16:37 +0000 (07:16 -0800)
commit067bf016e99ad72aa4ff869d6dec1fd62a9c6202
tree4380a30c12a04b9bfe65c3f847a6683a867e1380
parent96baf482ca1f69f0da9d10a5bd8422c87ea9039e
bonding: fix NULL pointer dereference in actor_port_prio setting

Liang reported an issue where setting a slave’s actor_port_prio to
predefined values such as 0, 255, or 65535 would cause a system crash.

The problem occurs because in bond_opt_parse(), when the provided value
matches a predefined table entry, the function returns that table entry,
which does not contain slave information. Later, in
bond_option_actor_port_prio_set(), calling bond_slave_get_rtnl() leads
to a NULL pointer dereference.

Since actor_port_prio is defined as a u16 and initialized to the default
value of 255 in ad_initialize_port(), there is no need for the
bond_actor_port_prio_tbl. Using the BOND_OPTFLAG_RAWVAL flag is sufficient.

Fixes: 6b6dc81ee7e8 ("bonding: add support for per-port LACP actor priority")
Reported-by: Liang Li <liali@redhat.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Link: https://patch.msgid.link/20251105072620.164841-1-liuhangbin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/net/bonding/bond_options.c