Commit 30021e969d48 for kernel

commit 30021e969d48e5819d5ae56936c2f34c0f7ce997
Author: Ricardo B. Marlière <rbm@suse.com>
Date:   Sat Mar 7 17:50:54 2026 -0300

    net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled

    When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never
    initialized because inet6_init() exits before ndisc_init() is called
    which initializes it. If bonding ARP/NS validation is enabled, an IPv6
    NS/NA packet received on a slave can reach bond_validate_na(), which
    calls bond_has_this_ip6(). That path calls ipv6_chk_addr() and can
    crash in __ipv6_chk_addr_and_flags().

     BUG: kernel NULL pointer dereference, address: 00000000000005d8
     Oops: Oops: 0000 [#1] SMP NOPTI
     RIP: 0010:__ipv6_chk_addr_and_flags+0x69/0x170
     Call Trace:
      <IRQ>
      ipv6_chk_addr+0x1f/0x30
      bond_validate_na+0x12e/0x1d0 [bonding]
      ? __pfx_bond_handle_frame+0x10/0x10 [bonding]
      bond_rcv_validate+0x1a0/0x450 [bonding]
      bond_handle_frame+0x5e/0x290 [bonding]
      ? srso_alias_return_thunk+0x5/0xfbef5
      __netif_receive_skb_core.constprop.0+0x3e8/0xe50
      ? srso_alias_return_thunk+0x5/0xfbef5
      ? update_cfs_rq_load_avg+0x1a/0x240
      ? srso_alias_return_thunk+0x5/0xfbef5
      ? __enqueue_entity+0x5e/0x240
      __netif_receive_skb_one_core+0x39/0xa0
      process_backlog+0x9c/0x150
      __napi_poll+0x30/0x200
      ? srso_alias_return_thunk+0x5/0xfbef5
      net_rx_action+0x338/0x3b0
      handle_softirqs+0xc9/0x2a0
      do_softirq+0x42/0x60
      </IRQ>
      <TASK>
      __local_bh_enable_ip+0x62/0x70
      __dev_queue_xmit+0x2d3/0x1000
      ? srso_alias_return_thunk+0x5/0xfbef5
      ? srso_alias_return_thunk+0x5/0xfbef5
      ? packet_parse_headers+0x10a/0x1a0
      packet_sendmsg+0x10da/0x1700
      ? kick_pool+0x5f/0x140
      ? srso_alias_return_thunk+0x5/0xfbef5
      ? __queue_work+0x12d/0x4f0
      __sys_sendto+0x1f3/0x220
      __x64_sys_sendto+0x24/0x30
      do_syscall_64+0x101/0xf80
      ? exc_page_fault+0x6e/0x170
      ? srso_alias_return_thunk+0x5/0xfbef5
      entry_SYSCALL_64_after_hwframe+0x77/0x7f
      </TASK>

    Fix this by checking ipv6_mod_enabled() before dispatching IPv6 packets to
    bond_na_rcv(). If IPv6 is disabled, return early from bond_rcv_validate()
    and avoid the path to ipv6_chk_addr().

    Suggested-by: Fernando Fernandez Mancera <fmancera@suse.de>
    Fixes: 4e24be018eb9 ("bonding: add new parameter ns_targets")
    Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
    Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
    Link: https://patch.msgid.link/20260307-net-nd_tbl_fixes-v4-2-e2677e85628c@suse.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index c1fb92602e46..707419270ebf 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3428,7 +3428,7 @@ int bond_rcv_validate(const struct sk_buff *skb, struct bonding *bond,
 	} else if (is_arp) {
 		return bond_arp_rcv(skb, bond, slave);
 #if IS_ENABLED(CONFIG_IPV6)
-	} else if (is_ipv6) {
+	} else if (is_ipv6 && likely(ipv6_mod_enabled())) {
 		return bond_na_rcv(skb, bond, slave);
 #endif
 	} else {