Commit 323ca2c2 authored Jul 24, 2023 by Jussi Maki Committed by Zhengchao Shao Jul 24, 2023

bonding: Fix negative jump label count on nested bonding

mainline inclusion
from mainline-v5.15-rc1
commit 6d5f1ef8
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I7NDRB
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6d5f1ef838683efba01bacb7854f6516fbcbae17



----------------------------------------

With nested bonding devices the nested bond device's ndo_bpf was
called without a program causing it to decrement the static key
without a prior increment leading to negative count.

Fix the issue by 1) only calling slave's ndo_bpf when there's a
program to be loaded and 2) only decrement the count when a program
is unloaded.

Fixes: 9e2ee5c7 ("net, bonding: Add XDP support to the bonding driver")
Reported-by:  <syzbot+30622fb04ddd72a4d167@syzkaller.appspotmail.com>
Signed-off-by: Jussi Maki <joamaki@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>

parent 7080a636

drivers/net/bonding/bond_main.c

+5 −6

Original line number	Diff line number	Diff line
		@@ -2139,7 +2139,7 @@ int bond_enslave(struct net_device bond_dev, struct net_device slave_dev,
		res = -EOPNOTSUPP;
		goto err_sysfs_del;
		}
		} else {
		} else if (bond->xdp_prog) {
		struct netdev_bpf xdp = {
		.command = XDP_SETUP_PROG,
		.flags = 0,
		@@ -5104,13 +5104,12 @@ static int bond_xdp_set(struct net_device dev, struct bpf_prog prog,
		bpf_prog_inc(prog);
		}

		if (old_prog)
		bpf_prog_put(old_prog);

		if (prog)
		if (prog) {
		static_branch_inc(&bpf_master_redirect_enabled_key);
		else
		} else if (old_prog) {
		bpf_prog_put(old_prog);
		static_branch_dec(&bpf_master_redirect_enabled_key);
		}

		return 0;