Subject: Re: [PATCHv2 net] bonding: alb: fix UAF in rlb_arp_recv during bond up/down

From: Jakub Kicinski <[email-masked]>
Date: Wed, 18 Feb 2026 16:11:10 -0800

On Wed, 18 Feb 2026 04:36:24 +0000 Hangbin Liu wrote:
> On Tue, Feb 17, 2026 at 04:43:55PM -0800, Jakub Kicinski wrote:
> > On Sat, 14 Feb 2026 09:15:41 +0000 Hangbin Liu wrote:  
> > > Fixes: e53665c6eaa6 ("bonding: delete migrated IP addresses from the rlb hash table")  
> > 
> > Ah, also AI says the issue existed already in 
> > 3aba891dde38 ("bonding: move processing of recv handlers into
> > handle_frame()")
> > not the exact trapping instruction but the hash table was used from
> > recv_probe so at least a UAF would happen.  
> 
> Not sure if I understand correctly. Do you mean we still able to access
> rlb_arp_recv() after setting recv_probe to NULL?

Simply put -- wasn't there a case where rx_hashtbl was accessed after
being freed in 3aba891dde38 already? That commit is a year and a half
older than the commit you had under Fixes.