[PATCH] bonding: unbind 802.3ad slaves on enslave failure

[Lin Jiapeng]

From: Lin Jiapeng <jiapenglin@xxxxxxxxxxx>

The 802.3ad enslave path binds a slave to an aggregator before publishing
it in the bond's slave list. This lets the periodic state machine select
the port and attach it to a LAG while enslavement is in progress.

If a later step fails, the rollback removes the slave and frees its
ad_slave_info without unbinding its port. A port selected in the meantime
can remain linked from another live slave's aggregator, so later LAG
processing accesses freed memory. A test-only kretprobe forces
bond_sysfs_slave_add() to return -ENOMEM, after which KASAN reports:
     BUG: KASAN: slab-use-after-free in ad_agg_selection_logic+0x1a0d/0x1fa0
     Read of size 1 at addr ff11000109be946e by task kworker/u16:0/13
     Freed by task 110:
       kasan_save_stack+0x30/0x50
       kasan_save_track+0x14/0x30
       kasan_save_free_info+0x3b/0x70
       __kasan_slab_free+0x47/0x70
       kfree+0x1b3/0x550
       slave_kobj_release+0xb6/0xd0
       kobject_put+0x17e/0x300
       bond_enslave+0x1acc/0x5090

Call bond_3ad_unbind_slave() in the common rollback for published slaves
before unlinking the slave from the bond. This detaches the port under
mode_lock and preserves the invalidate-drain-free ordering used by normal
release. Successful enslavement and earlier unpublished failures are
unchanged.

Fixes: 07699f9a7c8d ("bonding: add sysfs /slave dir for bond slave devices.")
Reported-by: TencentOS Corvus AI <corvus@xxxxxxxxxxx>
Signed-off-by: Lin Jiapeng <jiapenglin@xxxxxxxxxxx>
---
 drivers/net/bonding/bond_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index e9f5e753f677..60cc9a6a4fc7 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2355,6 +2355,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
 	bond_sysfs_slave_del(new_slave);
 
 err_upper_unlink:
+	if (BOND_MODE(bond) == BOND_MODE_8023AD)
+		bond_3ad_unbind_slave(new_slave);
 	bond_upper_dev_unlink(bond, new_slave);
 
 err_unregister:
-- 
2.55.0