Re: [PATCH net v3] bonding: fix slave_cnt leak on XDP error paths

[Hangbin Liu]

On Mon, Sep 07, 2026 at 10:41:50AM +0300, Nikolay Aleksandrov wrote:
> On 07/09/2026 10:07, Hangbin Liu wrote:
> > From: Hangbin Liu <liuhangbin@xxxxxxxxxx>
> > 
> > When bond_enslave() succeeds up to the XDP setup stage, slave_cnt is
> > already incremented. If XDP setup subsequently fails, the error paths
> > jump directly to err_sysfs_del, bypassing the slave_cnt decrement.
> > 
> > This causes slave_cnt to drift upward on each failed enslaving attempt,
> > which would lead to unbalanced traffic distribution with round-robin
> > mode.
> > 
> > Fix it by moving the slave_cnt increase after XDP setup.
> > 
> > Fixes: 9e2ee5c7e7c3 ("net, bonding: Add XDP support to the bonding driver")
> > Signed-off-by: Hangbin Liu <liuhangbin@xxxxxxxxxx>
> > ---
> > Changes in v3:
> > - move the slave_cnt increasement before bond_update_slave_arr() (selftest)
> > - run all bonding selftests on debug kernel to make sure no regression (Jakub)
> > - Link to v2: https://lore.kernel.org/r/20260903-bond_slave_cnt-v2-1-02e27304ca36@xxxxxxxxxx
> > 
> > Changes in v2:
> > - move the slave_cnt increasement after XDP setup (Nikolay Aleksandrov)
> > - balance-xor mode is not affected, not mention it (Nikolay Aleksandrov)
> > - Link to v1: https://lore.kernel.org/r/20260902-bond_slave_cnt-v1-1-36e95bf4a6ff@xxxxxxxxxx
> > ---
> >   drivers/net/bonding/bond_main.c | 4 +++-
> >   1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
> > index a9bff7663eec..1514a8ba0888 100644
> > --- a/drivers/net/bonding/bond_main.c
> > +++ b/drivers/net/bonding/bond_main.c
> > @@ -2284,7 +2284,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
> >   		}
> >   	}
> > -	WRITE_ONCE(bond->slave_cnt, bond->slave_cnt + 1);
> >   	netdev_compute_master_upper_features(bond->dev, true);
> >   	bond_set_carrier(bond);
> > @@ -2332,6 +2331,9 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
> >   			bpf_prog_inc(bond->xdp_prog);
> >   	}
> > +	/* Increase the slave count before rebuilding the slave arrays. */
> > +	WRITE_ONCE(bond->slave_cnt, bond->slave_cnt + 1);
> > +
> >   	/* broadcast mode uses the all_slaves to loop through slaves. */
> >   	if (bond_mode_can_use_xmit_hash(bond) ||
> >   	    BOND_MODE(bond) == BOND_MODE_BROADCAST)
> > 
> > ---
> > base-commit: 38b6be101006d3e7af972999f45d4f1e8250587a
> > change-id: 20260807-bond_slave_cnt-88e78c5f0ab9
> > 
> > Best regards,
> 
> I think the comment is redundant, of course we should change slave_cnt before it
> is used by anything that needs it.

Yeah, this is a reminder if someone else need to move it to other place.
I can remove it if others also ask.

> 
> Anyway, the patch looks good:
> Reviewed-by: Nikolay Aleksandrov <razor@xxxxxxxxxxxxx>

Thanks again for your review.

Regards
Hangbin