netdev - Re: [PATCH net] bonding: only set speed/duplex to unknown, if getting speed failed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3932974.1769787530@famine>
Date: Fri, 30 Jan 2026 07:38:50 -0800
From: Jay Vosburgh <jv@...sburgh.net>
To: Hangbin Liu <liuhangbin@...il.com>
cc: Thomas Bogendoerfer <tbogendoerfer@...e.de>,
    Andrew Lunn <andrew+netdev@...n.ch>,
    "David S. Miller" <davem@...emloft.net>,
    Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>,
    Paolo Abeni <pabeni@...hat.com>, netdev@...r.kernel.org,
    linux-kernel@...r.kernel.org
Subject: Re: [PATCH net] bonding: only set speed/duplex to unknown, if getting
 speed failed

Hangbin Liu <liuhangbin@...il.com> wrote:

>On Fri, Jan 30, 2026 at 12:19:04PM +0100, Thomas Bogendoerfer wrote:
>> bond_update_speed_duplex() first set speed/duplex to unknown and
>> then asks slave driver for current speed/duplex. Since getting
>> speed/duplex might take longer there is a race, where this false state
>> is visible by /proc/net/bonding. With commit 691b2bf14946 ("bonding:
>
>The patch looks good to me. But based on your description, I don't think
>the fixes tag is correct.

	Agreed on both points; I suspect the origin of the race window
is:

commit e9fe8efeeae11f19bb6fafd6153ec77deaeb4b83
Author: Nikolay Aleksandrov <razor@...ckwall.org>
Date:   Tue Sep 9 23:17:01 2014 +0200

    bonding: procfs: clean bond->lock usage and use RCU

	as this patch converted some locking in the procfs logic to be
solely RCU.

	-J

>Thanks
>Hangbin
>>  update port speed when getting bond speed") this race gets more visible,
>> if user space is calling ethtool on a regular base.
>> 
>> Fix this by only setting speed/duplex to unknown, if link speed is
>> really unknown/unusable.
>> 
>> Fixes: 691b2bf14946 ("bonding: update port speed when getting bond speed")
>> Signed-off-by: Thomas Bogendoerfer <tbogendoerfer@...e.de>
>> ---
>>  drivers/net/bonding/bond_main.c | 15 +++++++++------
>>  1 file changed, 9 insertions(+), 6 deletions(-)
>> 
>> diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
>> index e7caf400a59c..4cdf89b21ca0 100644
>> --- a/drivers/net/bonding/bond_main.c
>> +++ b/drivers/net/bonding/bond_main.c
>> @@ -791,26 +791,29 @@ static int bond_update_speed_duplex(struct slave *slave)
>>  	struct ethtool_link_ksettings ecmd;
>>  	int res;
>>  
>> -	slave->speed = SPEED_UNKNOWN;
>> -	slave->duplex = DUPLEX_UNKNOWN;
>> -
>>  	res = __ethtool_get_link_ksettings(slave_dev, &ecmd);
>>  	if (res < 0)
>> -		return 1;
>> +		goto speed_duplex_unknown;
>>  	if (ecmd.base.speed == 0 || ecmd.base.speed == ((__u32)-1))
>> -		return 1;
>> +		goto speed_duplex_unknown;
>>  	switch (ecmd.base.duplex) {
>>  	case DUPLEX_FULL:
>>  	case DUPLEX_HALF:
>>  		break;
>>  	default:
>> -		return 1;
>> +		goto speed_duplex_unknown;
>>  	}
>>  
>>  	slave->speed = ecmd.base.speed;
>>  	slave->duplex = ecmd.base.duplex;
>>  
>>  	return 0;
>> +
>> +speed_duplex_unknown:
>> +	slave->speed = SPEED_UNKNOWN;
>> +	slave->duplex = DUPLEX_UNKNOWN;
>> +
>> +	return 1;
>>  }
>>  
>>  const char *bond_slave_link_status(s8 link)
>> -- 
>> 2.43.0
>> 

---
	-Jay Vosburgh, jv@...sburgh.net