[PATCH net] bonding: fix u32 overflow in compute_gap()

[PATCH net] bonding: fix u32 overflow in compute_gap()

[Hangbin Liu]

From: Hangbin Liu <liuhangbin@kylinos.cn>

compute_gap() computes the gap between a slave's link capacity and its
current TLB load. Both terms use u32 left-shifts that overflow on modern
hardware:

  - slave->speed is u32 in Mbps; speed << 20 overflows at > 4Gbps.
  - SLAVE_TLB_INFO(slave).load is u32; load << 3 overflows at > 512M.

Cast both operands to s64 before shifting so the arithmetic is performed
in 64 bits. Also update the comment to make it more clear.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
 drivers/net/bonding/bond_alb.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 839f7482dc18..818c18c6ee52 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -160,8 +160,8 @@ static void tlb_deinitialize(struct bonding *bond)
 
 static long long compute_gap(struct slave *slave)
 {
-	return (s64) (slave->speed << 20) - /* Convert to Megabit per sec */
-	       (s64) (SLAVE_TLB_INFO(slave).load << 3); /* Bytes to bits */
+	return ((s64)slave->speed << 20) - /* Mbit/s -> bit/s */
+	       ((s64)SLAVE_TLB_INFO(slave).load << 3); /* Byte/s -> bit/s */
 }
 
 static struct slave *tlb_get_least_loaded_slave(struct bonding *bond)

---
base-commit: 44871eadd07a7f004aa00cb87399461eea08c630
change-id: 20260806-bond_overflow-ac6a6a78d6a0

Best regards,
-- 
Hangbin Liu <liuhangbin@kylinos.cn>

Re: [PATCH net] bonding: fix u32 overflow in compute_gap()

[Jakub Kicinski]

On Mon, 10 Aug 2026 10:38:23 +0800 Hangbin Liu wrote:
> From: Hangbin Liu <liuhangbin@kylinos.cn>
> 
> compute_gap() computes the gap between a slave's link capacity and its
> current TLB load. Both terms use u32 left-shifts that overflow on modern
> hardware:
> 
>   - slave->speed is u32 in Mbps; speed << 20 overflows at > 4Gbps.
>   - SLAVE_TLB_INFO(slave).load is u32; load << 3 overflows at > 512M.
> 
> Cast both operands to s64 before shifting so the arithmetic is performed
> in 64 bits. Also update the comment to make it more clear.

Could you clarify the impact in the commit message a little more
explicitly? If the links are the same speed -- does this fix still
matter?

AI over here says:

  The fix is incomplete for very high loads: each hash bucket’s u32 tx_bytes
  already wraps above roughly 3.44 Gbit/s sustained over the 10-second interval,
  and aggregate u32 load wraps above roughly 34.4 Gbit/s.

While these are not exactly the same lines of code - I think it'd be
worth to address them all in one series. 

> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>

Oh, you work at KylinOS now -- please clearly state in the commit
message if the issue was seen in real life or AI-detected.

Re: [PATCH net] bonding: fix u32 overflow in compute_gap()

[Hangbin Liu]

On Wed, Aug 12, 2026 at 06:01:11PM -0700, Jakub Kicinski wrote:
> On Mon, 10 Aug 2026 10:38:23 +0800 Hangbin Liu wrote:
> > From: Hangbin Liu <liuhangbin@kylinos.cn>
> > 
> > compute_gap() computes the gap between a slave's link capacity and its
> > current TLB load. Both terms use u32 left-shifts that overflow on modern
> > hardware:
> > 
> >   - slave->speed is u32 in Mbps; speed << 20 overflows at > 4Gbps.
> >   - SLAVE_TLB_INFO(slave).load is u32; load << 3 overflows at > 512M.
> > 
> > Cast both operands to s64 before shifting so the arithmetic is performed
> > in 64 bits. Also update the comment to make it more clear.
> 
> Could you clarify the impact in the commit message a little more
> explicitly? If the links are the same speed -- does this fix still
> matter?

No, with same high speed NICs. If one save has lower load, e.g. 3Gbit/s,
Another has higher load, e.g. 5Gbit/s. The higher load will overflow and
became a smaller value.

> 
> AI over here says:
> 
>   The fix is incomplete for very high loads: each hash bucket’s u32 tx_bytes
>   already wraps above roughly 3.44 Gbit/s sustained over the 10-second interval,
>   and aggregate u32 load wraps above roughly 34.4 Gbit/s.
> 
> While these are not exactly the same lines of code - I think it'd be
> worth to address them all in one series. 

Ah, yes. The load is already overflow here. Not in the gap compute.
So the gap compute fix is mainly for different speed NICs.

> 
> > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> > Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
> 
> Oh, you work at KylinOS now 

Right.

> -- please clearly state in the commit
> message if the issue was seen in real life or AI-detected.

OK, I will.

Thanks
Hangbin