linux-stable.git/drivers/net/bonding, branch linux-3.17.y

bond: Check length of IFLA_BOND_ARP_IP_TARGET attributes

2014-12-16T17:37:10+00:00

[ Upstream commit f6c6fda4c9e17940b0a2ba206b0408babfdc930c ]

Fixes: 7f28fa10 ("bonding: add arp_ip_target netlink support")
Reported-by: John Fastabend 
Cc: Scott Feldman 
Signed-off-by: Thomas Graf 
Acked-by: John Fastabend 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

bonding: fix curr_active_slave/carrier with loadbalance arp monitoring

2014-12-06T23:57:17+00:00

[ Upstream commit b8e4500f42fe4464a33a887579147050bed8fcef ]

Since commit 6fde8f037e60 ("bonding: fix locking in
bond_loadbalance_arp_mon()") we can have a stale bond carrier state and
stale curr_active_slave when using arp monitoring in loadbalance modes. The
reason is that in bond_loadbalance_arp_mon() we can't have
do_failover == true but slave_state_changed == false, whenever do_failover
is true then slave_state_changed is also true. Then the following piece
from bond_loadbalance_arp_mon():
                if (slave_state_changed) {
                        bond_slave_state_change(bond);
                        if (BOND_MODE(bond) == BOND_MODE_XOR)
                                bond_update_slave_arr(bond, NULL);
                } else if (do_failover) {
                        block_netpoll_tx();
                        bond_select_active_slave(bond);
                        unblock_netpoll_tx();
                }

will execute only the first branch, always and regardless of do_failover.
Since these two events aren't related in such way, we need to decouple and
consider them separately.

For example this issue could lead to the following result:
Bonding Mode: load balancing (round-robin)
*MII Status: down*
MII Polling Interval (ms): 0
Up Delay (ms): 0
Down Delay (ms): 0
ARP Polling Interval (ms): 100
ARP IP target/s (n.n.n.n form): 192.168.9.2

Slave Interface: ens12
*MII Status: up*
Speed: 10000 Mbps
Duplex: full
Link Failure Count: 2
Permanent HW addr: 00:0f:53:01:42:2c
Slave queue ID: 0

Slave Interface: eth1
*MII Status: up*
Speed: Unknown
Duplex: Unknown
Link Failure Count: 70
Permanent HW addr: 52:54:00:2f:0f:8e
Slave queue ID: 0

Since some interfaces are up, then the status of the bond should also be
up, but it will never change unless something invokes bond_set_carrier()
(i.e. enslave, bond_select_active_slave etc). Now, if I force the
calling of bond_select_active_slave via for example changing
primary_reselect (it can change in any mode), then the MII status goes to
"up" because it calls bond_select_active_slave() which should've been done
from bond_loadbalance_arp_mon() itself.

CC: Veaceslav Falico 
CC: Jay Vosburgh 
CC: Andy Gospodarek 
CC: Ding Tianhong 

Fixes: 6fde8f037e60 ("bonding: fix locking in bond_loadbalance_arp_mon()")
Signed-off-by: Nikolay Aleksandrov 
Acked-by: Veaceslav Falico 
Acked-by: Andy Gospodarek 
Acked-by: Ding Tianhong 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

bonding: fix div by zero while enslaving and transmitting

2014-09-13T21:16:56+00:00

The problem is that the slave is first linked and slave_cnt is
incremented afterwards leading to a div by zero in the modes that use it
as a modulus. What happens is that in bond_start_xmit()
bond_has_slaves() is used to evaluate further transmission and it becomes
true after the slave is linked in, but when slave_cnt is used in the xmit
path it is still 0, so fetch it once and transmit based on that. Since
it is used only in round-robin and XOR modes, the fix is only for them.
Thanks to Eric Dumazet for pointing out the fault in my first try to fix
this.

Call trace (took it out of net-next kernel, but it's the same with net):
[46934.330038] divide error: 0000 [#1] SMP
[46934.330041] Modules linked in: bonding(O) 9p fscache
snd_hda_codec_generic crct10dif_pclmul
[46934.330041] bond0: Enslaving eth1 as an active interface with an up
link
[46934.330051]  ppdev joydev crc32_pclmul crc32c_intel 9pnet_virtio
ghash_clmulni_intel snd_hda_intel 9pnet snd_hda_controller parport_pc
serio_raw pcspkr snd_hda_codec parport virtio_balloon virtio_console
snd_hwdep snd_pcm pvpanic i2c_piix4 snd_timer i2ccore snd soundcore
virtio_blk virtio_net virtio_pci virtio_ring virtio ata_generic
pata_acpi floppy [last unloaded: bonding]
[46934.330053] CPU: 1 PID: 3382 Comm: ping Tainted: G           O
3.17.0-rc4+ #27
[46934.330053] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[46934.330054] task: ffff88005aebf2c0 ti: ffff88005b728000 task.ti:
ffff88005b728000
[46934.330059] RIP: 0010:[]  []
bond_start_xmit+0x1c3/0x450 [bonding]
[46934.330060] RSP: 0018:ffff88005b72b7f8  EFLAGS: 00010246
[46934.330060] RAX: 0000000000000679 RBX: ffff88004b077000 RCX:
000000000000002a
[46934.330061] RDX: 0000000000000000 RSI: ffff88004b3f0500 RDI:
ffff88004b077940
[46934.330061] RBP: ffff88005b72b830 R08: 00000000000000c0 R09:
ffff88004a83e000
[46934.330062] R10: 000000000000ffff R11: ffff88004b1f12c0 R12:
ffff88004b3f0500
[46934.330062] R13: ffff88004b3f0500 R14: 000000000000002a R15:
ffff88004b077940
[46934.330063] FS:  00007fbd91a4c740(0000) GS:ffff88005f080000(0000)
knlGS:0000000000000000
[46934.330064] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[46934.330064] CR2: 00007f803a8bb000 CR3: 000000004b2c9000 CR4:
00000000000406e0
[46934.330069] Stack:
[46934.330071]  ffffffff811e6169 00000000e772fa05 ffff88004b077000
ffff88004b3f0500
[46934.330072]  ffffffff81d17d18 000000000000002a 0000000000000000
ffff88005b72b8a0
[46934.330073]  ffffffff81620108 ffffffff8161fe0e ffff88005b72b8c4
ffff88005b302000
[46934.330073] Call Trace:
[46934.330077]  [] ?
__kmalloc_node_track_caller+0x119/0x300
[46934.330084]  [] dev_hard_start_xmit+0x188/0x410
[46934.330086]  [] ? harmonize_features+0x2e/0x90
[46934.330088]  [] __dev_queue_xmit+0x456/0x590
[46934.330089]  [] dev_queue_xmit+0x10/0x20
[46934.330090]  [] arp_xmit+0x22/0x60
[46934.330091]  [] arp_send.part.16+0x30/0x40
[46934.330092]  [] arp_solicit+0x115/0x2b0
[46934.330094]  [] ? copy_skb_header+0x17/0xa0
[46934.330096]  [] neigh_probe+0x4a/0x70
[46934.330097]  [] __neigh_event_send+0xac/0x230
[46934.330098]  [] neigh_resolve_output+0x13b/0x220
[46934.330100]  [] ? ip_forward_options+0x1c0/0x1c0
[46934.330101]  [] ip_finish_output+0x1f8/0x860
[46934.330102]  [] ip_output+0x58/0x90
[46934.330103]  [] ? __ip_local_out+0xa2/0xb0
[46934.330104]  [] ip_local_out_sk+0x30/0x40
[46934.330105]  [] ip_send_skb+0x16/0x50
[46934.330106]  [] ip_push_pending_frames+0x33/0x40
[46934.330107]  [] raw_sendmsg+0x88c/0xa30
[46934.330110]  [] ? skb_recv_datagram+0x41/0x60
[46934.330111]  [] ? raw_recvmsg+0xa9/0x1f0
[46934.330113]  [] inet_sendmsg+0x74/0xc0
[46934.330114]  [] ? inet_recvmsg+0x8b/0xb0
[46934.330115] bond0: Adding slave eth2
[46934.330116]  [] sock_sendmsg+0x9c/0xe0
[46934.330118]  [] ?
move_addr_to_kernel.part.20+0x28/0x80
[46934.330121]  [] ? might_fault+0x47/0x50
[46934.330122]  [] ___sys_sendmsg+0x3a9/0x3c0
[46934.330125]  [] ? n_tty_write+0x3aa/0x530
[46934.330127]  [] ? __wake_up+0x44/0x50
[46934.330129]  [] ? fsnotify+0x238/0x310
[46934.330130]  [] __sys_sendmsg+0x51/0x90
[46934.330131]  [] SyS_sendmsg+0x12/0x20
[46934.330134]  [] system_call_fastpath+0x16/0x1b
[46934.330144] Code: 48 8b 10 4c 89 ee 4c 89 ff e8 aa bc ff ff 31 c0 e9
1a ff ff ff 0f 1f 00 4c 89 ee 4c 89 ff e8 65 fb ff ff 31 d2 4c 89 ee 4c
89 ff  b3 64 09 00 00 e8 02 bd ff ff 31 c0 e9 f2 fe ff ff 0f 1f 00
[46934.330146] RIP  [] bond_start_xmit+0x1c3/0x450
[bonding]
[46934.330146]  RSP 

CC: Eric Dumazet 
CC: Andy Gospodarek 
CC: Jay Vosburgh 
CC: Veaceslav Falico 
Fixes: 278b208375 ("bonding: initial RCU conversion")
Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller

net:bonding: Add missing space in bonding driver parameter description

2014-09-10T03:38:03+00:00

This patch adds missing space between "interface" and "by"
in bonding module parameter description.

Signed-off-by: Masanari Iida 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2014-08-06T01:46:26+00:00

Conflicts:
	drivers/net/Makefile
	net/ipv6/sysctl_net_ipv6.c

Two ipv6_table_template[] additions overlap, so the index
of the ipv6_table[x] assignments needed to be adjusted.

In the drivers/net/Makefile case, we've gotten rid of the
garbage whereby we had to list every single USB networking
driver in the top-level Makefile, there is just one
"USB_NETWORKING" that guards everything.

Signed-off-by: David S. Miller

bonding: use kobject_put instead of _del after kobject_add

2014-07-31T18:16:09+00:00

Otherwise the name of the kobject isn't getting freed and other stuff from
kobject_cleanup() isn't getting called. kobject_put() will call
kobject_del() on its own in kobject_cleanup().

CC: Jay Vosburgh 
CC: Andy Gospodarek 
Signed-off-by: Veaceslav Falico 
Signed-off-by: David S. Miller

bonding: fix a memory leak in bond_arp_send_all()

2014-07-29T00:27:47+00:00

This test is reversed so the memory is always leaked.  It's better style
to remove the test anyway.

Fixes: 3e403a77779f ('bonding: make it possible to have unlimited nested upper vlans')
Signed-off-by: Dan Carpenter 
Acked-by: Veaceslav Falico 
Signed-off-by: David S. Miller

bonding: make it possible to have unlimited nested upper vlans

2014-07-21T03:35:00+00:00

Currently we're limited by a constant level of vlan nestings, and fail to
find anything beyound that level (currently 2).

To fix this - remove the limit of nestings when going through device tree,
and when the end device is found - allocate the needed amount of vlan tags
and return them, instead of found/not found.

CC: Jay Vosburgh 
CC: Andy Gospodarek 
Signed-off-by: Veaceslav Falico 
Signed-off-by: David S. Miller

bonding: destroy proc directory only after all bonds are gone

2014-07-17T23:33:27+00:00

Currently we might arrive to bond_net_exit() with some bonds left (that
were created while the module is unloading). We take care of that by
destroying sysfs (the last possibility to add new bonds) and then
destroying all the remaining bonds.

However, we destroy the /proc/net/bonding directory before destroying those
last bonds, and get a warning that we're trying to destroy a non-empty
proc directory (containing /proc/net/bonding/bondX).

Fix this by moving bond_destroy_proc_dir() after all the bonds are
destroyed, so that we're sure that no bonds exist.

CC: Jay Vosburgh 
CC: Andy Gospodarek 
Signed-off-by: Veaceslav Falico 
Signed-off-by: David S. Miller

bonding: use rtnl_deref in bond_change_rx_flags()

2014-07-17T23:06:52+00:00

As it's always called with RTNL held, via dev_set_allmulti/promiscuity.
Also, remove the wrong comment.

CC: Jay Vosburgh 
CC: Andy Gospodarek 
Signed-off-by: Veaceslav Falico 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller