Re: [PATCH net v5 2/2] bonding: fix u32 overflow in compute_gap()
From: David Laight
Date: Thu Aug 27 2026 - 16:56:31 EST
On Thu, 27 Aug 2026 22:09:04 +0300
Nikolay Aleksandrov <razor@xxxxxxxxxxxxx> wrote:
> On 27/08/2026 21:20, David Laight wrote:
> > On Tue, 25 Aug 2026 09:01:30 +0800
> > Hangbin Liu <hangbin.liu@xxxxxxxxx> wrote:
> >
> >> From: Hangbin Liu <liuhangbin@xxxxxxxxxx>
> >>
> >> The TLB load-tracking fields tx_bytes, load_history, load, and
> >> unbalanced_load are all u32. At sustained throughput above ~3.2 Gbit/s
> >> over the 10-second rebalance interval the byte counters wrap, causing
> >> compute_gap() to produce incorrect gap values and mis-select slaves.
> >> Such speeds are common on modern NICs under heavy traffic.
> >>
> >> Widen these fields to u64. Use u64_stats_sync to protect the per-cpu
> >> unbalanced_load_stats against tearing on 32-bit architectures, and
> >> div_u64() for the 64-bit divisions. The tx_bytes and load_history
> >> are protected in spin_lock. Also protect the slave load writing in
> >> bond_alb_monitor() with spin_lock in case of tear on 32-bit.
> >
> > How about changing the rebalance interval to either 8 or 16 seconds
> > to avoid the expensive divide?
> > Alternatively multiply the other side of the comparisons by the interval,
> > replacing the expensive divide with a cheap multiply.
> >
> > David
> >
>
> How is that relevant to these patches?
> And how does that help at all if today that is done at about 10 second interval?
The 10 seconds is almost certainly completely arbitrary.
It is relevant because the 64bit divide is significantly expensive on 32bit.
David
>
> >>
> >> Rework compute_gap() to use s64 arithmetic throughout. Return LLONG_MIN
> >> when the speed is unknown.
> >>
> >> Detected by AI code review.
> >>
> >> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> >> Signed-off-by: Hangbin Liu <liuhangbin@xxxxxxxxxx>
> >> ---
> >> drivers/net/bonding/bond_alb.c | 52 ++++++++++++++++++++++++++++++------------
> >> include/net/bond_alb.h | 11 +++++----
> >> 2 files changed, 44 insertions(+), 19 deletions(-)
> >>
> >> diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
> >> index 0afed2c39231..9a43a1f47893 100644
> >> --- a/drivers/net/bonding/bond_alb.c
> >> +++ b/drivers/net/bonding/bond_alb.c
> >> @@ -6,6 +6,7 @@
> >> #include <linux/skbuff.h>
> >> #include <linux/netdevice.h>
> >> #include <linux/etherdevice.h>
> >> +#include <linux/ethtool.h>
> >> #include <linux/pkt_sched.h>
> >> #include <linux/spinlock.h>
> >> #include <linux/slab.h>
> >> @@ -74,8 +75,8 @@ static inline u8 _simple_hash(const u8 *hash_start, int hash_size)
> >> static inline void tlb_init_table_entry(struct tlb_client_info *entry, int save_load)
> >> {
> >> if (save_load) {
> >> - entry->load_history = 1 + entry->tx_bytes /
> >> - BOND_TLB_REBALANCE_INTERVAL;
> >> + entry->load_history = 1 + div_u64(entry->tx_bytes,
> >> + BOND_TLB_REBALANCE_INTERVAL);
> >> entry->tx_bytes = 0;
> >> }
> >>
> >> @@ -133,7 +134,7 @@ static int tlb_initialize(struct bonding *bond)
> >> if (!new_hashtbl)
> >> return -ENOMEM;
> >>
> >> - bond_info->unbalanced_load = alloc_percpu(struct unbalanced_load_stats);
> >> + bond_info->unbalanced_load = netdev_alloc_pcpu_stats(struct unbalanced_load_stats);
> >> if (!bond_info->unbalanced_load)
> >> goto out;
> >>
> >> @@ -170,8 +171,14 @@ static void tlb_deinitialize(struct bonding *bond)
> >>
> >> static long long compute_gap(struct slave *slave)
> >> {
> >> - return (s64) (slave->speed << 20) - /* Convert to Megabit per sec */
> >> - (s64) (SLAVE_TLB_INFO(slave).load << 3); /* Bytes to bits */
> >> + u32 raw_speed = READ_ONCE(slave->speed);
> >> +
> >> + /* It's meaningless to compare gap on unknown speed NIC */
> >> + if (raw_speed == (u32)SPEED_UNKNOWN)
> >> + return LLONG_MIN;
> >> +
> >> + return ((s64)raw_speed << 20) - /* Convert to bits per sec */
> >> + ((s64)SLAVE_TLB_INFO(slave).load << 3); /* Bytes to bits */
> >> }
> >>
> >> static struct slave *tlb_get_least_loaded_slave(struct bonding *bond)
> >> @@ -188,7 +195,7 @@ static struct slave *tlb_get_least_loaded_slave(struct bonding *bond)
> >> if (bond_slave_can_tx(slave)) {
> >> long long gap = compute_gap(slave);
> >>
> >> - if (max_gap < gap) {
> >> + if (!least_loaded || max_gap < gap) {
> >> least_loaded = slave;
> >> max_gap = gap;
> >> }
> >> @@ -1354,8 +1361,14 @@ static netdev_tx_t bond_do_alb_xmit(struct sk_buff *skb, struct bonding *bond,
> >> if (!tx_slave) {
> >> /* unbalanced or unassigned, send through primary */
> >> tx_slave = rcu_dereference(bond->curr_active_slave);
> >> - if (bond->params.tlb_dynamic_lb)
> >> - this_cpu_add(bond_info->unbalanced_load->tx_bytes, skb->len);
> >> + if (bond->params.tlb_dynamic_lb) {
> >> + struct unbalanced_load_stats *pcpu_load;
> >> +
> >> + pcpu_load = this_cpu_ptr(bond_info->unbalanced_load);
> >> + u64_stats_update_begin(&pcpu_load->syncp);
> >> + u64_stats_add(&pcpu_load->tx_bytes, skb->len);
> >> + u64_stats_update_end(&pcpu_load->syncp);
> >> + }
> >> }
> >>
> >> if (tx_slave && bond_slave_can_tx(tx_slave)) {
> >> @@ -1539,21 +1552,27 @@ netdev_tx_t bond_alb_xmit(struct sk_buff *skb, struct net_device *bond_dev)
> >> return bond_do_alb_xmit(skb, bond, tx_slave);
> >> }
> >>
> >> -static u32 reset_unbalanced_load(struct alb_bond_info *bond_info)
> >> +static u64 reset_unbalanced_load(struct alb_bond_info *bond_info)
> >> {
> >> + u64 delta, tx_bytes, total_bytes = 0;
> >> struct unbalanced_load_stats *p;
> >> - u32 delta, total_bytes = 0;
> >> + unsigned int start;
> >> int i;
> >>
> >> for_each_possible_cpu(i) {
> >> p = per_cpu_ptr(bond_info->unbalanced_load, i);
> >> - total_bytes += READ_ONCE(p->tx_bytes);
> >> + do {
> >> + start = u64_stats_fetch_begin(&p->syncp);
> >> + tx_bytes = u64_stats_read(&p->tx_bytes);
> >> + } while (u64_stats_fetch_retry(&p->syncp, start));
> >> +
> >> + total_bytes += tx_bytes;
> >> }
> >>
> >> delta = total_bytes - bond_info->prev_total_unbalanced;
> >> bond_info->prev_total_unbalanced = total_bytes;
> >>
> >> - return delta / BOND_TLB_REBALANCE_INTERVAL;
> >> + return div_u64(delta, BOND_TLB_REBALANCE_INTERVAL);
> >> }
> >>
> >> void bond_alb_monitor(struct work_struct *work)
> >> @@ -1597,8 +1616,13 @@ void bond_alb_monitor(struct work_struct *work)
> >> if (atomic_read(&bond_info->tx_rebalance_counter) >= BOND_TLB_REBALANCE_TICKS) {
> >> bond_for_each_slave_rcu(bond, slave, iter) {
> >> tlb_clear_slave(bond, slave, 1);
> >> - if (slave == rcu_access_pointer(bond->curr_active_slave))
> >> - SLAVE_TLB_INFO(slave).load = reset_unbalanced_load(bond_info);
> >> + if (slave == rcu_access_pointer(bond->curr_active_slave)) {
> >> + u64 new_load = reset_unbalanced_load(bond_info);
> >> +
> >> + spin_lock_bh(&bond->mode_lock);
> >> + SLAVE_TLB_INFO(slave).load = new_load;
> >> + spin_unlock_bh(&bond->mode_lock);
> >> + }
> >> }
> >> atomic_set(&bond_info->tx_rebalance_counter, 0);
> >> }
> >> diff --git a/include/net/bond_alb.h b/include/net/bond_alb.h
> >> index 6fb09b4fc7e2..32f1981033e4 100644
> >> --- a/include/net/bond_alb.h
> >> +++ b/include/net/bond_alb.h
> >> @@ -57,12 +57,12 @@ struct tlb_client_info {
> >> * packets to a Client that the Hash function
> >> * gave this entry index.
> >> */
> >> - u32 tx_bytes; /* Each Client accumulates the BytesTx that
> >> + u64 tx_bytes; /* Each Client accumulates the BytesTx that
> >> * were transmitted to it, and after each
> >> * CallBack the LoadHistory is divided
> >> * by the balance interval
> >> */
> >> - u32 load_history; /* This field contains the amount of Bytes
> >> + u64 load_history; /* This field contains the amount of Bytes
> >> * that were transmitted to this client by
> >> * the server on the previous balance
> >> * interval in Bps.
> >> @@ -118,19 +118,20 @@ struct tlb_slave_info {
> >> * are the entries that were assigned to use this
> >> * slave for transmit.
> >> */
> >> - u32 load; /* Each slave sums the loadHistory of all clients
> >> + u64 load; /* Each slave sums the loadHistory of all clients
> >> * assigned to it
> >> */
> >> };
> >>
> >> struct unbalanced_load_stats {
> >> - u32 tx_bytes;
> >> + u64_stats_t tx_bytes;
> >> + struct u64_stats_sync syncp;
> >> };
> >>
> >> struct alb_bond_info {
> >> struct tlb_client_info *tx_hashtbl; /* Dynamically allocated */
> >> struct unbalanced_load_stats __percpu *unbalanced_load;
> >> - u32 prev_total_unbalanced;
> >> + u64 prev_total_unbalanced;
> >> atomic_t tx_rebalance_counter;
> >> int lp_counter;
> >> /* -------- rlb parameters -------- */
> >>
> >
>