mirror of
https://github.com/torvalds/linux.git
synced 2026-10-06 18:46:02 +02:00
af602c7aa5
When releasing all slaves during bond destruction (all == true),
__bond_release_one() unconditionally clears bond->curr_active_slave to
NULL in every iteration.
If a backup slave is released before the active slave,
bond_alb_deinit_slave() triggers rlb_teach_disabled_mac_on_primary(),
which increments the active slave dev promiscuity counter and sets
bond_info->primary_is_promisc = 1.
Because bond->curr_active_slave was prematurely cleared to NULL when
releasing the backup slave, the subsequent iteration releasing the active
slave evaluates oldcurrent as NULL, so bond_change_active_slave(bond, NULL)
is skipped. Consequently, bond_alb_handle_active_change() is never called
to decrement the promiscuity counter, permanently leaking promiscuous
mode on the physical device after bond teardown.
When oldcurrent == slave, bond_change_active_slave(bond, NULL) already sets
bond->curr_active_slave to NULL. We only need to avoid selecting a new
active slave when all == true. Replace the if (all) branch with
if (!all && oldcurrent == slave).
Fixes:
|
||
|---|---|---|
| .. | ||
| bond_3ad.c | ||
| bond_alb.c | ||
| bond_debugfs.c | ||
| bond_main.c | ||
| bond_netlink.c | ||
| bond_options.c | ||
| bond_procfs.c | ||
| bond_sysfs_slave.c | ||
| bond_sysfs.c | ||
| Makefile | ||