Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2227595/?format=api
{ "id": 2227595, "url": "http://patchwork.ozlabs.org/api/patches/2227595/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/20260423204841.3528502-2-tim.whisonant@canonical.com/", "project": { "id": 15, "url": "http://patchwork.ozlabs.org/api/projects/15/?format=api", "name": "Ubuntu Kernel", "link_name": "ubuntu-kernel", "list_id": "kernel-team.lists.ubuntu.com", "list_email": "kernel-team@lists.ubuntu.com", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260423204841.3528502-2-tim.whisonant@canonical.com>", "list_archive_url": null, "date": "2026-04-23T20:48:37", "name": "[SRU,J/N,1/1] net: bonding: fix use-after-free in bond_xmit_broadcast()", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "e8283a79bb9a412c42fac7b2f3670dadb6c644f6", "submitter": { "id": 89903, "url": "http://patchwork.ozlabs.org/api/people/89903/?format=api", "name": "Tim Whisonant", "email": "tim.whisonant@canonical.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/20260423204841.3528502-2-tim.whisonant@canonical.com/mbox/", "series": [ { "id": 501275, "url": "http://patchwork.ozlabs.org/api/series/501275/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/list/?series=501275", "date": "2026-04-23T20:48:37", "name": "[SRU,J/N,1/1] net: bonding: fix use-after-free in bond_xmit_broadcast()", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/501275/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2227595/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2227595/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<kernel-team-bounces@lists.ubuntu.com>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (4096-bit key;\n unprotected) header.d=canonical.com header.i=@canonical.com\n header.a=rsa-sha256 header.s=20251003 header.b=EmZHbc2+;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com\n (client-ip=185.125.189.65; helo=lists.ubuntu.com;\n envelope-from=kernel-team-bounces@lists.ubuntu.com;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g1wqc5lzZz1yDD\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 24 Apr 2026 11:49:16 +1000 (AEST)", "from localhost ([127.0.0.1] helo=lists.ubuntu.com)\n\tby lists.ubuntu.com with esmtp (Exim 4.86_2)\n\t(envelope-from <kernel-team-bounces@lists.ubuntu.com>)\n\tid 1wG5fF-0007Ao-FQ; Fri, 24 Apr 2026 01:49:05 +0000", "from smtp-relay-internal-1.internal ([10.131.114.114]\n helo=smtp-relay-internal-1.canonical.com)\n by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.86_2) (envelope-from <tim.whisonant@canonical.com>)\n id 1wG0yh-0005Yb-VB\n for kernel-team@lists.ubuntu.com; Thu, 23 Apr 2026 20:48:52 +0000", "from mail-ot1-f70.google.com (mail-ot1-f70.google.com\n [209.85.210.70])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 29CD03F9C9\n for <kernel-team@lists.ubuntu.com>; Thu, 23 Apr 2026 20:48:51 +0000 (UTC)", "by mail-ot1-f70.google.com with SMTP id\n 46e09a7af769-7d496d080d8so9093385a34.0\n for <kernel-team@lists.ubuntu.com>; Thu, 23 Apr 2026 13:48:51 -0700 (PDT)", "from localhost (104-6-108-11.lightspeed.frokca.sbcglobal.net.\n [104.6.108.11]) by smtp.gmail.com with ESMTPSA id\n 46e09a7af769-7dce5c346adsm5704697a34.27.2026.04.23.13.48.48\n for <kernel-team@lists.ubuntu.com>\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Thu, 23 Apr 2026 13:48:48 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com;\n s=20251003; t=1776977331;\n bh=T/BMC2iXaAQDhrajzvmsmbz480/tx3kDJqndLmF8K38=;\n h=From:To:Subject:Date:Message-ID:In-Reply-To:References:\n MIME-Version;\n b=EmZHbc2+7tq+TzLQuyk1OHt0TfRANuPSy1E1LfdHDAX52rXe+jUBfkLPQbHP4yfXL\n fCIPB/ZJTc0BrhGAmgAhsaj7NiEIeYcqR/be7jSQzdoo2NYU9W9FxcNfoLDhDpAqXF\n +kk5y/qQWPIHRgeQrW76DV6s2AIj4hZoPVBpsQgcU0rKo0tELgyFZJMLwMNclR1nkt\n 8si7+z5DpdrXCQh8bJ1MQztO1/JkuRw9rh6znX0cjhhr9EbBhnGnpH3sT2PRJyWC6Z\n LvKoTt0zEKQcqvjdexax/KrtI3u++Ip60dO3M+lrcwb9MuMv+iSjZZ81vZHRTGJ6VL\n vw/vTf56o4nyOFnNkoCi1eM2CdjsPC8eSCbFlkn18qtrnmAFhZNnRVRi7UhXKhFJL0\n hRydtWbRiBidpYH0s91cppCsKcobw5chk87OvjvavgBCOy92uWJC8UAUVhE27eR5os\n fyqSRfP11Pt0zysFS8gDdu1IZU7fJzq0ELI8W/4Kf+6zBLxKJqDBYx7K44UfVfn3rz\n JPvRTf+GjdzbIsRFLmkfxE9qmW5lqDcv5ui8WQB4Hk761o+4sx0tAT3KVXt+uFELnP\n kzqhkskj74t8G/DnFFghAYzbeTo63pFhy2HtLDvyskW3787b8CHJ/4Coal6xQqQ9e2\n r4QQic9x/CPrparudTZDZuR0=", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776977329; x=1777582129;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to\n :cc:subject:date:message-id:reply-to;\n bh=T/BMC2iXaAQDhrajzvmsmbz480/tx3kDJqndLmF8K38=;\n b=efXfBO9yD5XuNtjb0ezXEofBMnfR77P3xsh//+Rh6LAvs7tr8olPeJDDUVHOlWDZYF\n k+gLU6OvEsiRUob1CsmCUR6IG0uXEW5he+cP1+6fqPou+dR9XTUHFiYHZAsUZ5nuWk2U\n 7SHB7XiypKMPjp1np569o/CE+YOEaDeZiASrWEb5lR6FJbCWm4D9ZnRGDQIdOqtZ7Xs9\n jdFsZ8DPst6M098Kkr4PPRSrZXBErNRccyorVTkRtiI2jQpHipK2dh7CrpYqSXkEaTLq\n geiJOvTxwmpF6XOpJwniXhnzTpajuPyvnqzaiziS4uGZBEAU9M9U9UuUqY2IBQXADNxm\n FuJQ==", "X-Gm-Message-State": "AOJu0YxIy38J5yTLt0XFmqn0eitn8+WNnOpycV+RlBmRu0+g5zFC6iy4\n truBN9jjWayPy+inHSr1C+jIBUwVVLh0R588zLOFQulESYxoyUb5rE+NqHxyJ1xLwB1pE07108f\n AHR5ieVAvlF0Kb9LUUMIzw+9aswq/dB9od5fsiCgNt8l5NUiwXnIlUxnyjUdVYSgd4gnLck0tsT\n 6IpfkOVOR0SQExUg==", "X-Gm-Gg": "AeBDievlj7eIbINBGkWc1oWFgSDnOT5M0dsnoDtwgUfbv+Nkr2+wZtB+45R+9NYFWLd\n wNCKHIPwZ66bkJFxMN2voPAw40290WKAX+hC89engAeaH+ykhQ1czgJOr32shZMnk4aR2eNjaG1\n rIvTGWVlr580x0T2eG+wvOfoixUXR06UHhyi4lMOi9msYFcEDaHBxtnw1++q6NeiwRlqYwaO0iF\n gHvENTiib6pjiBSoArPQC9RXAIyzd7XpqQdJwUxp+r+d2/5h9j641ka/hRi31Ml02pWPLZiKNXo\n W8gyGfuKhPreG8D2e8XGfzWlH1cHu7z2G8H82lQRfBufbQzMMI5d9YgJyMfQpU7FvucAYEn83BY\n oKZ2Jy7qNcipMzKwJwmoE8KUXFo7ral6moMcg/aqsrpjacNj+v8vrKMg6x6+M1+5A7FshgJqJ27\n furM5m0jTGcQ8a", "X-Received": [ "by 2002:a9d:5501:0:b0:7dc:c4ae:a689 with SMTP id\n 46e09a7af769-7dcc4aeb216mr7901180a34.2.1776977329490;\n Thu, 23 Apr 2026 13:48:49 -0700 (PDT)", "by 2002:a9d:5501:0:b0:7dc:c4ae:a689 with SMTP id\n 46e09a7af769-7dcc4aeb216mr7901168a34.2.1776977328986;\n Thu, 23 Apr 2026 13:48:48 -0700 (PDT)" ], "From": "Tim Whisonant <tim.whisonant@canonical.com>", "To": "kernel-team@lists.ubuntu.com", "Subject": "[SRU][J/N][PATCH 1/1] net: bonding: fix use-after-free in\n bond_xmit_broadcast()", "Date": "Thu, 23 Apr 2026 13:48:37 -0700", "Message-ID": "<20260423204841.3528502-2-tim.whisonant@canonical.com>", "X-Mailer": "git-send-email 2.43.0", "In-Reply-To": "<20260423204841.3528502-1-tim.whisonant@canonical.com>", "References": "<20260423204841.3528502-1-tim.whisonant@canonical.com>", "MIME-Version": "1.0", "X-BeenThere": "kernel-team@lists.ubuntu.com", "X-Mailman-Version": "2.1.20", "Precedence": "list", "List-Id": "Kernel team discussions <kernel-team.lists.ubuntu.com>", "List-Unsubscribe": "<https://lists.ubuntu.com/mailman/options/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=unsubscribe>", "List-Archive": "<https://lists.ubuntu.com/archives/kernel-team>", "List-Post": "<mailto:kernel-team@lists.ubuntu.com>", "List-Help": "<mailto:kernel-team-request@lists.ubuntu.com?subject=help>", "List-Subscribe": "<https://lists.ubuntu.com/mailman/listinfo/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=subscribe>", "Content-Type": "text/plain; charset=\"utf-8\"", "Content-Transfer-Encoding": "base64", "Errors-To": "kernel-team-bounces@lists.ubuntu.com", "Sender": "\"kernel-team\" <kernel-team-bounces@lists.ubuntu.com>" }, "content": "From: Xiang Mei <xmei5@asu.edu>\n\nbond_xmit_broadcast() reuses the original skb for the last slave\n(determined by bond_is_last_slave()) and clones it for others.\nConcurrent slave enslave/release can mutate the slave list during\nRCU-protected iteration, changing which slave is \"last\" mid-loop.\nThis causes the original skb to be double-consumed (double-freed).\n\nReplace the racy bond_is_last_slave() check with a simple index\ncomparison (i + 1 == slaves_count) against the pre-snapshot slave\ncount taken via READ_ONCE() before the loop. This preserves the\nzero-copy optimization for the last slave while making the \"last\"\ndetermination stable against concurrent list mutations.\n\nThe UAF can trigger the following crash:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in skb_clone\nRead of size 8 at addr ffff888100ef8d40 by task exploit/147\n\nCPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY\nCall Trace:\n <TASK>\n dump_stack_lvl (lib/dump_stack.c:123)\n print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n kasan_report (mm/kasan/report.c:597)\n skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108)\n bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334)\n bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593)\n dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887)\n __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838)\n ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136)\n ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219)\n ip6_output (net/ipv6/ip6_output.c:250)\n ip6_send_skb (net/ipv6/ip6_output.c:1985)\n udp_v6_send_skb (net/ipv6/udp.c:1442)\n udpv6_sendmsg (net/ipv6/udp.c:1733)\n __sys_sendto (net/socket.c:730 net/socket.c:742 net/socket.c:2206)\n __x64_sys_sendto (net/socket.c:2209)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n </TASK>\n\nAllocated by task 147:\n\nFreed by task 147:\n\nThe buggy address belongs to the object at ffff888100ef8c80\n which belongs to the cache skbuff_head_cache of size 224\nThe buggy address is located 192 bytes inside of\n freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60)\n\nMemory state around the buggy address:\n ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc\n ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n>ffff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\n ^\n ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb\n ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n==================================================================\n\nFixes: 4e5bd03ae346 (\"net: bonding: fix bond_xmit_broadcast return value error bug\")\nReported-by: Weiming Shi <bestswngs@gmail.com>\nSigned-off-by: Xiang Mei <xmei5@asu.edu>\nLink: https://patch.msgid.link/20260326075553.3960562-1-xmei5@asu.edu\nSigned-off-by: Paolo Abeni <pabeni@redhat.com>\n(backported from commit 2884bf72fb8f03409e423397319205de48adca16)\n[tswhison: leveraged ce7a381697c\n(\"net: bonding: add broadcast_neighbor option for 802.3ad\")\nwhich was not present here to implement the looping logic, in\nthis case over bond->all_slaves. Using the indexed-based\nlooping logic avoids the race caused by bond_is_last_slave().]\nCVE-2026-31419\nSigned-off-by: Tim Whisonant <tim.whisonant@canonical.com>\n---\n drivers/net/bonding/bond_main.c | 12 ++++++++----\n 1 file changed, 8 insertions(+), 4 deletions(-)", "diff": "diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c\nindex e6394fd45f6df..9003da1e7e9c6 100644\n--- a/drivers/net/bonding/bond_main.c\n+++ b/drivers/net/bonding/bond_main.c\n@@ -4898,18 +4898,22 @@ static netdev_tx_t bond_xmit_broadcast(struct sk_buff *skb,\n \t\t\t\t struct net_device *bond_dev)\n {\n \tstruct bonding *bond = netdev_priv(bond_dev);\n-\tstruct slave *slave = NULL;\n-\tstruct list_head *iter;\n+\tstruct bond_up_slave *slaves;\n \tbool xmit_suc = false;\n \tbool skb_used = false;\n+\tint slaves_count, i;\n \n-\tbond_for_each_slave_rcu(bond, slave, iter) {\n+\tslaves = rcu_dereference(bond->all_slaves);\n+\n+\tslaves_count = slaves ? READ_ONCE(slaves->count) : 0;\n+\tfor (i = 0; i < slaves_count; i++) {\n+\t\tstruct slave *slave = slaves->arr[i];\n \t\tstruct sk_buff *skb2;\n \n \t\tif (!(bond_slave_is_up(slave) && slave->link == BOND_LINK_UP))\n \t\t\tcontinue;\n \n-\t\tif (bond_is_last_slave(bond, slave)) {\n+\t\tif (i + 1 == slaves_count) {\n \t\t\tskb2 = skb;\n \t\t\tskb_used = true;\n \t\t} else {\n", "prefixes": [ "SRU", "J/N", "1/1" ] }