Re: [PATCH net 1/2] bonding: reject frames with insufficient headroom in bond_header_create

Hi Qinghang,

On Mon, Aug 24, 2026 at 10:18:01AM +0800, Qihang wrote:

From: Qihang Tang <redacted>

AF_PACKET SOCK_DGRAM sends reserve skb headroom from a snapshot of
bond_dev->hard_header_len.  A concurrent bond type change can switch the
active slave to one with a larger hard_header_len between that snapshot
and bond_header_create(), so the slave's create() pushes or writes past
skb->head.

How can bonding change its device type while still sending skbs?
Bonding does not allow enslaving devices of different types. We have
to remove all slaves before changing its type.

Thanks
Hangbin