Subject: Re: [PATCH net v5 0/2] net,bpf: fix null-ptr-deref in xdp_master_redirect() for bonding and add selftest

From: "Jiayuan Chen" <[email-masked]>
Date: Mon, 09 Mar 2026 09:41:20 +0000

March 9, 2026 at 15:46, "Eric Dumazet" <[email-masked] mailto:[email-masked]?to=%22Eric%20Dumazet%22%20%3Cedumazet%40google.com%3E > wrote:

> 
> On Mon, Mar 9, 2026 at 4:07 AM Jiayuan Chen <[email-masked]> wrote:
> 
> > 
> > syzkaller reported a kernel panic [1] with the following crash stack:
> > 
> >  Call Trace:
> >  BUG: unable to handle page fault for address: ffff8ebd08580000
> >  PF: supervisor write access in kernel mode
> >  PF: error_code(0x0002) - not-present page
> >  PGD 11f201067 P4D 11f201067 PUD 0
> >  Oops: Oops: 0002 [#1] SMP PTI
> >  CPU: 2 UID: 0 PID: 451 Comm: test_progs Not tainted 6.19.0+ #161 PREEMPT_RT
> >  RIP: 0010:bond_rr_gen_slave_id+0x90/0xd0
> >  RSP: 0018:ffffd3f4815f3448 EFLAGS: 00010246
> >  RAX: 0000000000000001 RBX: 0000000000000001 RCX: ffff8ebc8728b17e
> >  RDX: 0000000000000000 RSI: ffffd3f4815f3538 RDI: ffff8ebc8abcce40
> >  RBP: ffffd3f4815f3460 R08: 0000000000000000 R09: 0000000000000000
> >  R10: 0000000000000000 R11: 0000000000000000 R12: ffffd3f4815f3538
> >  R13: ffff8ebc8abcce40 R14: ffff8ebc8728b17f R15: ffff8ebc8728b170
> >  CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >  CR2: ffff8ebd08580000 CR3: 000000010a808006 CR4: 0000000000770ef0
> >  PKRU: 55555554
> >  Call Trace:
> >  <TASK>
> >  bond_xdp_get_xmit_slave+0xc0/0x240
> >  xdp_master_redirect+0x74/0xc0
> >  bpf_prog_run_generic_xdp+0x2f2/0x3f0
> >  do_xdp_generic+0x1fd/0x3d0
> >  __netif_receive_skb_core.constprop.0+0x30d/0x1220
> >  __netif_receive_skb_list_core+0xfc/0x250
> >  netif_receive_skb_list_internal+0x20c/0x3d0
> >  ? eth_type_trans+0x137/0x160
> >  netif_receive_skb_list+0x25/0x140
> >  xdp_test_run_batch.constprop.0+0x65b/0x6e0
> >  bpf_test_run_xdp_live+0x1ec/0x3b0
> >  bpf_prog_test_run_xdp+0x49d/0x6e0
> >  __sys_bpf+0x446/0x27b0
> >  __x64_sys_bpf+0x1a/0x30
> >  x64_sys_call+0x146c/0x26e0
> >  do_syscall_64+0xd3/0x1510
> >  entry_SYSCALL_64_after_hwframe+0x76/0x7e
> > 
> Please, can you always provide symbols in such traces ?
> You can use scripts/decode_stacktrace.sh to make the trace really
> nice, instead of ugly.
> 

Hi Eric,

Thank you for the suggestion. I didn't include the fully decoded stack 
trace in the cover letter because the syzkaller report already contains 
the complete information. You can find it here if needed:

https://syzkaller.appspot.com/text?tag=CrashReport&x=15448952580000
https://syzkaller.appspot.com/bug?extid=80e046b8da2820b6ba73