[PATCH 1/2] bonding: 3ad: fix NULL pointer dereference in ad_mux_machine()

[Hangbin Liu]

From: Hangbin Liu <liuhangbin@xxxxxxxxxx>

In bond_3ad_state_machine_handler(), ad_port_selection_logic() runs
before ad_mux_machine() for each port. When ad_port_selection_logic()
detaches a port from its current aggregator but fails to find a
suitable replacement, it returns early, leaving port->aggregator as
NULL. The subsequent call to ad_mux_machine() then dereferences the
NULL aggregator in multiple switch branches, triggering a kernel oops.

Add a NULL check for the aggregator at the top of ad_mux_machine() and
return early. This avoids needing null guards in later branches.

Detected by AI code review.

Fixes: c4f050ce06c5 ("bonding: 3ad: implement proper RCU rules for port->aggregator")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Hangbin Liu <liuhangbin@xxxxxxxxxx>
---
 drivers/net/bonding/bond_3ad.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index acbba08dbdfa..196830fca4a4 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -1053,6 +1053,9 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr)
 	last_state = port->sm_mux_state;
 
 	aggregator = rcu_dereference(port->aggregator);
+	if (!aggregator)
+		return;
+
 	if (port->sm_vars & AD_PORT_BEGIN) {
 		port->sm_mux_state = AD_MUX_DETACHED;
 	} else {

-- 
2.55.0