Re: [PATCH] bonding: alb: Fix overflow in TLB gap calculation

[Xuanqiang Luo <xuanqiang.luo@linux.dev>]

在 2026/9/13 20:58, lirongqing 写道:
> From: Li RongQing <lirongqing@baidu.com>
> 
> compute_gap() shifts 32-bit values before converting them to s64,
> which can overflow for high speed network devices. The overflowed
> value is then incorrectly used in the TLB load balancing calculation.
> 
> Convert the operands to s64 before shifting so the arithmetic is done
> in 64-bit width.
> 
> Fixes: 097811bb48c7 ("bonding: optimize tlb_get_least_loaded_slave")
> Cc: stable@vger.kernel.org
> Signed-off-by: Li RongQing <lirongqing@baidu.com>
> ---
>   drivers/net/bonding/bond_alb.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
> index 43ac8e2..b520040 100644
> --- a/drivers/net/bonding/bond_alb.c
> +++ b/drivers/net/bonding/bond_alb.c
> @@ -160,8 +160,8 @@ static void tlb_deinitialize(struct bonding *bond)
>   
>   static long long compute_gap(struct slave *slave)
>   {
> -	return (s64) (slave->speed << 20) - /* Convert to Megabit per sec */
> -	       (s64) (SLAVE_TLB_INFO(slave).load << 3); /* Bytes to bits */
> +	return ((s64)slave->speed << 20) - /* Convert to Megabit per sec */
> +	       ((s64)SLAVE_TLB_INFO(slave).load << 3); /* Bytes to bits */
>   }
>   
>   static struct slave *tlb_get_least_loaded_slave(struct bonding *bond)

This appears to have already been fixed by Hangbin Liu.

Please see:
https://lore.kernel.org/all/20260831-bond_overflow-v6-2-ffb0ed1f7268@kylinos.cn/