From: Jiayuan Chen <jiayuan.chen@linux.dev>
To: Qihang <q.h.hack.winter@gmail.com>,
Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Cc: jv@jvosburgh.net, jiri@resnulli.us, andrew+netdev@lunn.ch,
davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
pabeni@redhat.com, willemb@google.com, netdev@vger.kernel.org,
stable@vger.kernel.org, Hangbin Liu <hangbin.liu@linux.dev>
Subject: Re: [PATCH net 1/2] bonding: reject frames with insufficient headroom in bond_header_create
Date: Thu, 27 Aug 2026 13:10:26 +0800 [thread overview]
Message-ID: <7488c912-76bc-4412-a03f-5435ad6d4d93@linux.dev> (raw)
In-Reply-To: <CAH78GvvF-mBij7exwgkthJC2puz1-1Ti=WkNr2PwFcKr_v5U4Q@mail.gmail.com>
在 8/27/26 11:13 AM, Qihang 写道:
> Hi Willem,
>
> I'll resend this as v2 with a cover letter.
>
> On scope: I grepped every header_ops->create. Five devices delegate to a
> lower device (bond, team, macvlan, ipvlan, 6lowpan), but only bond and
> team re-select that lower device under RCU -- the rest bind it at netdev
> creation. So bond and team are the full scope.
>
> Re Fixes: I used 950803f because it introduced bond_header_create (where
> this check lives); before it the type-confusion BUG masked this race.
> Happy to point at 1284cd3a2b74 instead if you prefer.
Can you check whether IPoIB + bond hits the issue you describe? That combo
isn't affected by 950803f (ipoib_hard_header doesn't use netdev_priv, no
type
confusion), so if it overflows, the Fixes tag shouldn't point to 950803f.
next prev parent reply other threads:[~2026-08-27 5:10 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-24 2:18 [PATCH net 1/2] bonding: reject frames with insufficient headroom in bond_header_create Qihang
2026-08-24 2:18 ` [PATCH net 2/2] team: reject frames with insufficient headroom in team_header_create Qihang
2026-08-26 2:02 ` [PATCH net 1/2] bonding: reject frames with insufficient headroom in bond_header_create Willem de Bruijn
2026-08-27 3:13 ` Qihang
2026-08-27 5:10 ` Jiayuan Chen [this message]
2026-08-27 21:37 ` Willem de Bruijn
2026-08-28 1:12 ` Hangbin Liu
2026-08-28 2:43 ` Willem de Bruijn
2026-08-28 6:07 ` Qihang
2026-08-28 20:26 ` Willem de Bruijn
2026-08-27 1:10 ` Hangbin Liu
2026-08-27 3:25 ` Qihang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7488c912-76bc-4412-a03f-5435ad6d4d93@linux.dev \
--to=jiayuan.chen@linux.dev \
--cc=andrew+netdev@lunn.ch \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=hangbin.liu@linux.dev \
--cc=jiri@resnulli.us \
--cc=jv@jvosburgh.net \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=q.h.hack.winter@gmail.com \
--cc=stable@vger.kernel.org \
--cc=willemb@google.com \
--cc=willemdebruijn.kernel@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox