)]}'
{
  "commit": "641f6bd58e060e095b56c0307945430ee63ca12c",
  "tree": "f17ea71cc14faf00c4e953dce31d471ea8361cc6",
  "parents": [
    "5c42b0051ac417b2df1dc8742fb1ae6a55453d55"
  ],
  "author": {
    "name": "Zhaolong Zhang",
    "email": "zhangzl68@chinatelecom.cn",
    "time": "Tue Jul 07 09:06:22 2026 +0800"
  },
  "committer": {
    "name": "Kevin Liu",
    "email": "zhihuil@google.com",
    "time": "Mon Aug 17 15:13:30 2026 -0700"
  },
  "message": "bonding: fix devconf_all NULL dereference when IPv6 is disabled\n\n[ Upstream commit 1c975de3343cdef506f2eecc833cc1f14b0401c4 ]\n\nWhen booting with the \u0027ipv6.disable\u003d1\u0027 parameter, the devconf_all is\nnever initialized because inet6_init() exits before addrconf_init() is\ncalled which initializes it. bond_send_validate(), however, will still\ncall bond_ns_send_all() even ipv6 is indeed disabled. It will lead to\nNULL derefence of net-\u003eipv6.devconf_all in ip6_pol_route().\n\n BUG: kernel NULL pointer dereference, address: 000000000000000c\n [...]\n Workqueue: bond0 bond_arp_monitor [bonding]\n RIP: 0010:ip6_pol_route+0x69/0x480\n [...]\n Call Trace:\n  \u003cTASK\u003e\n  ? srso_return_thunk+0x5/0x5f\n  ? __pfx_ip6_pol_route_output+0x10/0x10\n  fib6_rule_lookup+0xfe/0x260\n  ? wakeup_preempt+0x8a/0x90\n  ? srso_return_thunk+0x5/0x5f\n  ? srso_return_thunk+0x5/0x5f\n  ? sched_balance_rq+0x369/0x810\n  ip6_route_output_flags+0xd7/0x170\n  bond_ns_send_all+0xde/0x280 [bonding]\n  bond_ab_arp_probe+0x296/0x320 [bonding]\n  ? srso_return_thunk+0x5/0x5f\n  bond_activebackup_arp_mon+0xb4/0x2c0 [bonding]\n  process_one_work+0x196/0x370\n  worker_thread+0x1af/0x320\n  ? srso_return_thunk+0x5/0x5f\n  ? __pfx_worker_thread+0x10/0x10\n  kthread+0xe3/0x120\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork+0x199/0x260\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork_asm+0x1a/0x30\n  \u003c/TASK\u003e\n\nFix this by adding ipv6_mod_enabled() condition check in the caller.\n\nBUG\u003db/545106732\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2026-68336 in the Linux kernel.\n\ncos-patch: security-moderate\nFixes: 4e24be018eb9 (\"bonding: add new parameter ns_targets\")\nChange-Id: I0d73782feffc9ebe329c8211d6e3c5ae3475827d\nSigned-off-by: Qianheng Peng \u003cpengqh1@chinatelecom.cn\u003e\nSigned-off-by: Zhaolong Zhang \u003czhangzl68@chinatelecom.cn\u003e\nReviewed-by: Hangbin Liu \u003cliuhangbin@gmail.com\u003e\nLink: https://patch.msgid.link/20260707010622.487333-1-zhangzl2013@126.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: kevin liu \u003czhihuil@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/185086\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Derek Taylor \u003cddtaylor@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "7b8555f6102a82eba18a69ee10b086d489f171a7",
      "old_mode": 33188,
      "old_path": "drivers/net/bonding/bond_main.c",
      "new_id": "0f5a3144dec8d2d8c50299631edee7f7ffe406ea",
      "new_mode": 33188,
      "new_path": "drivers/net/bonding/bond_main.c"
    }
  ]
}