From nobody Sat Sep 26 00:31:12 2026 Received: from mta0.migadu.com (out-27.mta0.migadu.com [91.218.175.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EF5E83E49FE for ; Mon, 7 Sep 2026 07:08:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.27 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788764903; cv=none; b=Wo2hnScy7LcQszcXq8bSKx7TPHdnxrfB2jyNNagXwAfM7Iidy5eXgtuZQ6sr45GPgZheIIzUUMVa1VPvSlFx2yfvmWh7YS/+RZ1ekB9i6UgMDUJZbIfWxP0m1txiymGlLflNGcRwYe9EYosdkvmSU8aPwCJXpTpLo9SfESCeUZE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788764903; c=relaxed/simple; bh=nV5+II1fALDOgMZJw5NeP0syCJgew30SZ/qsXoP2ri8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=DrTNyroY2YOi0teavV/s8Auyf1CtvBA/hUf7sbQ7OAnH5brgkR9/ZutPeLTxss3PIiBqVSecdujkBveWu8ybg5oulc6sZQzNgfx76Bblz3Sw9AIYkKzTimIgTl6cSXQHprXc6/6mF4i0XHHz83IHQPT2gC63Tpyd6nrWWsPeNPw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=QNvv9WBn; arc=none smtp.client-ip=91.218.175.27 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="QNvv9WBn" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=nV5+II1fALDOgMZJw5NeP0syCJgew30SZ/qsXoP2ri8=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1788764899; v=1; x=1789369699; b=QNvv9WBnAyASpvB3bf6H125KIhansOBIUi+66dJmbnHXfby/V/m6EGel0mVkY+uw7sqk53/s pbGx+kIB72T5sqPb7s+IdOWiirdmzCABZ1MJtxxkBMVWXIOsybCoKiCKid3+IF3tpAAyWdPiJcJ VejQra7wubTaXpqDoxYQJyB4= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id 7c224f9ee2c31f1d; Mon, 07 Sep 2026 07:08:09 +0000 X-Mizu-Trace-ID: 7c224f9ee2c31f1d X-Migadu-Flow: FLOW_OUT From: Hangbin Liu Date: Mon, 07 Sep 2026 15:07:53 +0800 Subject: [PATCH net v3] bonding: fix slave_cnt leak on XDP error paths Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260907-bond_slave_cnt-v3-1-57df3b3cf2cb@kylinos.cn> X-B4-Tracking: v=1; b=H4sIAAAAAAAC/2WNywrDIBREf6XcdS1GE2O66n+UEoy5NtKgRYM0h Px7xVUfy5nhnNkgYrAY4XzYIGCy0XqXAz8eQE/K3ZHYMWdglAkqaUsG78Y+ziphr91CpMRW6sZ QNXSQoWdAY19FeAWHC9xyOdm4+LCWk1SVqfg6yn59qSIV4QK7ZjC1EsZcHutsnY8n7YorsU+e/ /Es85QhazmtteLii9/3/Q2wy7CP8gAAAA== X-Change-ID: 20260807-bond_slave_cnt-88e78c5f0ab9 To: Jay Vosburgh , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Daniel Borkmann , Jussi Maki , Nikolay Aleksandrov Cc: Hangbin Liu , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Hangbin Liu X-Mailer: b4 0.14.3 From: Hangbin Liu When bond_enslave() succeeds up to the XDP setup stage, slave_cnt is already incremented. If XDP setup subsequently fails, the error paths jump directly to err_sysfs_del, bypassing the slave_cnt decrement. This causes slave_cnt to drift upward on each failed enslaving attempt, which would lead to unbalanced traffic distribution with round-robin mode. Fix it by moving the slave_cnt increase after XDP setup. Fixes: 9e2ee5c7e7c3 ("net, bonding: Add XDP support to the bonding driver") Signed-off-by: Hangbin Liu Reviewed-by: Nikolay Aleksandrov --- Changes in v3: - move the slave_cnt increasement before bond_update_slave_arr() (selftest) - run all bonding selftests on debug kernel to make sure no regression (Jak= ub) - Link to v2: https://lore.kernel.org/r/20260903-bond_slave_cnt-v2-1-02e273= 04ca36@kylinos.cn Changes in v2: - move the slave_cnt increasement after XDP setup (Nikolay Aleksandrov) - balance-xor mode is not affected, not mention it (Nikolay Aleksandrov) - Link to v1: https://lore.kernel.org/r/20260902-bond_slave_cnt-v1-1-36e95b= f4a6ff@kylinos.cn --- drivers/net/bonding/bond_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_mai= n.c index a9bff7663eec..1514a8ba0888 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -2284,7 +2284,6 @@ int bond_enslave(struct net_device *bond_dev, struct = net_device *slave_dev, } } =20 - WRITE_ONCE(bond->slave_cnt, bond->slave_cnt + 1); netdev_compute_master_upper_features(bond->dev, true); bond_set_carrier(bond); =20 @@ -2332,6 +2331,9 @@ int bond_enslave(struct net_device *bond_dev, struct = net_device *slave_dev, bpf_prog_inc(bond->xdp_prog); } =20 + /* Increase the slave count before rebuilding the slave arrays. */ + WRITE_ONCE(bond->slave_cnt, bond->slave_cnt + 1); + /* broadcast mode uses the all_slaves to loop through slaves. */ if (bond_mode_can_use_xmit_hash(bond) || BOND_MODE(bond) =3D=3D BOND_MODE_BROADCAST) --- base-commit: 38b6be101006d3e7af972999f45d4f1e8250587a change-id: 20260807-bond_slave_cnt-88e78c5f0ab9 Best regards, --=20 Hangbin Liu