Re: [PATCH net v2] bonding: fix slave_cnt leak on XDP error paths

[Nikolay Aleksandrov <razor@blackwall.org>]

On 03/09/2026 13:38, Matthieu Baerts wrote:
> Hi Hangbin,
> 
> On 03/09/2026 10:10, Hangbin Liu wrote:
>> From: Hangbin Liu <liuhangbin@kylinos.cn>
>>
>> When bond_enslave() succeeds up to the XDP setup stage, slave_cnt is
>> already incremented. If XDP setup subsequently fails, the error paths
>> jump directly to err_sysfs_del, bypassing the slave_cnt decrement.
>>
>> This causes slave_cnt to drift upward on each failed enslaving attempt,
>> which would lead to unbalanced traffic distribution with round-robin
>> mode.
>>
>> Fix it by moving the slave_cnt increasement after XDP setup.
> Thank you for the fix, but it looks like it causes multiple KASAN
> issues, see:
> 
>   - https://netdev.bots.linux.dev/flakes.html?ld-remote=virt-bonding-dbg
> 
>   -
> https://netdev.bots.linux.dev/branch_deltas/net-next-2026-09-03--09-00.html
> 
> e.g.
> 
> 
> https://lore.kernel.org/netdev/20260903-bond_slave_cnt-v2-1-02e27304ca36@kylinos.cn/raw
> 
> Cheers,
> Matt

Waaait a second, it is moved after slave arr update, yes that would cause those.
I missed it in the review, in my suggestion I specifically said it must be before
the slave array update because it uses slave_cnt.

It must be moved up. :)

Thanks,
  Nik