diff options
| author | Eric Dumazet <edumazet@google.com> | 2026-03-15 13:41:52 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-03-25 13:08:53 +0300 |
| commit | 946bb6cacf0ccada7bc80f1cfa07c1ed79511c1c (patch) | |
| tree | e9ed88c1ea13294b6560b7edd18dbd2c7989bc83 /include/linux/if_ether.h | |
| parent | c6febaacfb8a0aec7d771a0e6c21cd68102d5679 (diff) | |
| download | linux-946bb6cacf0ccada7bc80f1cfa07c1ed79511c1c.tar.xz | |
bonding: prevent potential infinite loop in bond_header_parse()
[ Upstream commit b7405dcf7385445e10821777143f18c3ce20fa04 ]
bond_header_parse() can loop if a stack of two bonding devices is setup,
because skb->dev always points to the hierarchy top.
Add new "const struct net_device *dev" parameter to
(struct header_ops)->parse() method to make sure the recursion
is bounded, and that the final leaf parse method is called.
Fixes: 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Tested-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Cc: Jay Vosburgh <jv@jvosburgh.net>
Cc: Andrew Lunn <andrew+netdev@lunn.ch>
Link: https://patch.msgid.link/20260315104152.1436867-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'include/linux/if_ether.h')
| -rw-r--r-- | include/linux/if_ether.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h index 8a9792a6427a..47a0feffc121 100644 --- a/include/linux/if_ether.h +++ b/include/linux/if_ether.h @@ -37,7 +37,8 @@ static inline struct ethhdr *inner_eth_hdr(const struct sk_buff *skb) return (struct ethhdr *)skb_inner_mac_header(skb); } -int eth_header_parse(const struct sk_buff *skb, unsigned char *haddr); +int eth_header_parse(const struct sk_buff *skb, const struct net_device *dev, + unsigned char *haddr); extern ssize_t sysfs_format_mac(char *buf, const unsigned char *addr, int len); |