Commit 70f3995830d3 for kernel

commit 70f3995830d3f1e79faa14eb0605914f778feca9
Author: Eric Dumazet <edumazet@google.com>
Date:   Mon Aug 31 19:46:26 2026 +0000

    bonding: alb: fix uninitialized transport header access in alb_determine_nd()

    alb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers.
    However, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets
    or forwarded packets), skb->transport_header is not guaranteed to be
    initialized. While pskb_network_may_pull() ensures the packet data is
    linear starting from the network header, it does not set or adjust the
    transport header offset.

    Dereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory.

    Fetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(),
    and reload ipv6hdr in case pskb_may_pull() reallocated skb->head.
    Also remove the unused bond argument from alb_determine_nd().

    Fixes: 0da8aa00bfcf ("net: bonding: Add support for IPV6 ns/na to balance-alb/balance-tlb mode")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Reviewed-by: Joe Damato <joe@dama.to>
    Link: https://patch.msgid.link/20260831194626.119371-1-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index d2fb67a47cf9..654f051d0023 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -1281,10 +1281,10 @@ static int alb_set_mac_address(struct bonding *bond, void *addr)
 }

 /* determine if the packet is NA or NS */
-static bool alb_determine_nd(struct sk_buff *skb, struct bonding *bond)
+static bool alb_determine_nd(struct sk_buff *skb)
 {
-	struct ipv6hdr *ip6hdr;
-	struct icmp6hdr *hdr;
+	const struct ipv6hdr *ip6hdr;
+	const struct icmp6hdr *hdr;

 	if (!pskb_network_may_pull(skb, sizeof(*ip6hdr)))
 		return true;
@@ -1296,7 +1296,8 @@ static bool alb_determine_nd(struct sk_buff *skb, struct bonding *bond)
 	if (!pskb_network_may_pull(skb, sizeof(*ip6hdr) + sizeof(*hdr)))
 		return true;

-	hdr = icmp6_hdr(skb);
+	ip6hdr = ipv6_hdr(skb);
+	hdr = (const struct icmp6hdr *)(ip6hdr + 1);
 	return hdr->icmp6_type == NDISC_NEIGHBOUR_ADVERTISEMENT ||
 		hdr->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION;
 }
@@ -1381,7 +1382,7 @@ struct slave *bond_xmit_tlb_slave_get(struct bonding *bond,
 	if (!is_multicast_ether_addr(eth_data->h_dest)) {
 		switch (skb->protocol) {
 		case htons(ETH_P_IPV6):
-			if (alb_determine_nd(skb, bond))
+			if (alb_determine_nd(skb))
 				break;
 			fallthrough;
 		case htons(ETH_P_IP):
@@ -1467,7 +1468,7 @@ struct slave *bond_xmit_alb_slave_get(struct bonding *bond,
 			break;
 		}

-		if (alb_determine_nd(skb, bond)) {
+		if (alb_determine_nd(skb)) {
 			do_tx_balance = false;
 			break;
 		}