Subject: Re: [PATCH net v2 0/2] bonding: fix NULL deref in bond_rr_gen_slave_id

From: Jay Vosburgh <[email-masked]>
Date: Tue, 20 Sep 2022 10:53:56 -0700

Jonathan Toppins <[email-masked]> wrote:

>Fix a NULL dereference of the struct bonding.rr_tx_counter member because
>if a bond is initially created with an initial mode != zero (Round Robin)
>the memory required for the counter is never created and when the mode is
>changed there is never any attempt to verify the memory is allocated upon
>switching modes.
>
>The first patch provides a selftest to demonstrate the issue and the
>second patch fixes the issue.
>
>Jonathan Toppins (2):
>  selftests: bonding: cause oops in bond_rr_gen_slave_id
>  bonding: fix NULL deref in bond_rr_gen_slave_id

	For the series:

Acked-by: Jay Vosburgh <[email-masked]>

> drivers/net/bonding/bond_main.c               | 15 +++---
> .../selftests/drivers/net/bonding/Makefile    |  3 +-
> .../bonding/bond-arp-interval-causes-panic.sh | 49 +++++++++++++++++++
> 3 files changed, 57 insertions(+), 10 deletions(-)
> create mode 100755 tools/testing/selftests/drivers/net/bonding/bond-arp-interval-causes-panic.sh
>
>-- 
>2.31.1
>