Re: [PATCH] bonding: reject IEEE 802.15.4 and 6LoWPAN devices in bond_enslave

[KALPESH SOLANKI]

Hi,

To provide the requested context for reviewers:

1. Discovery:
The issue was identified via manual code inspection of bond_enslave()
following up on commit 9043be310c6a ("team: reject CAN, IEEE 802.15.4
and 6LoWPAN devices in team_port_add"). Commit 9043be310c6a noted that
bonding had only blocked CAN devices (commit 8ba68464e478), leaving
bonding exposed to the exact same IEEE 802.15.4 and 6LoWPAN type
inconsistencies.

2. Triggering / Symptoms:
The bug is triggerable at runtime by creating an IEEE 802.15.4 device
(e.g., via mac802154_hwsim or fakelb) or 6LoWPAN device, enslaving it
while down to a bonding master, and:
- For IEEE 802.15.4: issuing a netlink dump (e.g., IEEE802154_LLSEC_LIST_KEY),
  where ieee802154_llsec_dump_table() unconditionally dereferences
  dev->ieee802154_ptr / ieee802154_mlme_ops(dev) on the bond device,
  causing a NULL pointer dereference (as dev->ml_priv is NULL).
- For 6LoWPAN: on NETDEV_DOWN, lowpan_event() casts netdev_priv(dev) to
  struct lowpan_dev and writes to ctx.table, corrupting struct bonding.

Thanks,
Kalpesh