bonding: Fix negative jump label count on nested bonding

With nested bonding devices the nested bond device's ndo_bpf was
called without a program causing it to decrement the static key
without a prior increment leading to negative count.

Fix the issue by 1) only calling slave's ndo_bpf when there's a
program to be loaded and 2) only decrement the count when a program
is unloaded.

Fixes: 9e2ee5c7e7c3 ("net, bonding: Add XDP support to the bonding driver")
Reported-by: syzbot+30622fb04ddd72a4d167@syzkaller.appspotmail.com
Signed-off-by: Jussi Maki <joamaki@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 3858da3d3ea7e1d8c756487a7c7a1f8619f43dd2..77dc79a7f5748b5e675104e94d9c6624743d079b 100644 (file)
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2169,7 +2169,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
                        res = -EOPNOTSUPP;
                        goto err_sysfs_del;
                }
-       } else {
+       } else if (bond->xdp_prog) {
                struct netdev_bpf xdp = {
                        .command = XDP_SETUP_PROG,
                        .flags   = 0,
@@ -5224,13 +5224,12 @@ static int bond_xdp_set(struct net_device *dev, struct bpf_prog *prog,
                        bpf_prog_inc(prog);
        }
 
-       if (old_prog)
-               bpf_prog_put(old_prog);
-
-       if (prog)
+       if (prog) {
                static_branch_inc(&bpf_master_redirect_enabled_key);
-       else
+       } else if (old_prog) {
+               bpf_prog_put(old_prog);
                static_branch_dec(&bpf_master_redirect_enabled_key);
+       }
 
        return 0;