diff options
| author | Eric Dumazet <edumazet@google.com> | 2026-03-15 10:41:52 +0000 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-03-16 19:29:45 -0700 |
| commit | b7405dcf7385445e10821777143f18c3ce20fa04 (patch) | |
| tree | 3eb6579409018c3cd699b6c521201a4e6dfb5d7d /include/uapi/linux/wimax/git@git.tavy.me:linux.git | |
| parent | 43d222fbcdff9a715dbe63a0c9e5902f1c9ddd10 (diff) | |
bonding: prevent potential infinite loop in bond_header_parse()
bond_header_parse() can loop if a stack of two bonding devices is setup,
because skb->dev always points to the hierarchy top.
Add new "const struct net_device *dev" parameter to
(struct header_ops)->parse() method to make sure the recursion
is bounded, and that the final leaf parse method is called.
Fixes: 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Tested-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Cc: Jay Vosburgh <jv@jvosburgh.net>
Cc: Andrew Lunn <andrew+netdev@lunn.ch>
Link: https://patch.msgid.link/20260315104152.1436867-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'include/uapi/linux/wimax/git@git.tavy.me:linux.git')
0 files changed, 0 insertions, 0 deletions
