Re: [PATCH net] bonding: fix skb_under_panic in bond_ns_send() over stacked VLANs

[Hangbin Liu <liuhangbin@gmail.com>]

Hi Xiang,

On 29.07.2026 16:30, Xiang Mei wrote:
>>         Does adding one or two more nested VLANs move the panic into the
>> above call path?
>>
>
>No, for both of the reasons above: there is no room to add more
>(-EMLINK at N = 7), and skb_cow_head() would absorb it if there were.

What about the scenario that involves nested VLANs? For example:

vlan.1 - vlan.1.2 ... vlan.1..6 - bond - bond.1 - bond.1.2 ... bond.1..6?

>Both symptoms have the same cause, tags inserted before any header
>exists, so the fix is to build the probe in the order the stack uses:
>
>  - push the IPv6 header first, so the reservation is consumed up front
>    and the later tag inserts grow the head via skb_vlan_push() instead
>    of eating it;
>
>  - run the probe through NF_INET_LOCAL_OUT as a bare IPv6 packet,
>    exactly what ndisc_send_skb() feeds the hooks today.  This needs a
>    small export (ndisc_attach_dst()) because ip6_route_me_harder()
>    dereferences skb_dst() unconditionally;
>
>  - only then push the link-layer header and add the VLAN tags, so they
>    land at a real Ethernet header and the target address is untouched.
>
>With that applied the N = 1..6 wire capture is clean throughout.  I kept
>LOCAL_OUT deliberately so NS monitoring keeps traversing netfilter the
>way it does today; dropping it would be simpler, but a silent behaviour
>change.
>
>I am not familiar with the bonding and ndisc internals, so I posted it as
>an RFC rather than presenting it as settled:
>
>  https://lore.kernel.org/netdev/20260729230119.2717507-1-xmei5@asu.edu/T/#t

I'm not sure if calling NF_INET_LOCAL_OUT in bond code is a good idea. Waiting
for other's opinion.

Thanks
Hangbin