linux-stable.git/drivers/net/bonding, branch v3.9.2

bonding: in bond_mc_swap() bond's mc addr list is walked without lock

2013-04-19T21:48:19+00:00

Use netif_addr_lock_bh() to acquire the appropriate lock before walking.

Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller

bonding: disable netpoll on enslave failure

2013-04-19T21:48:19+00:00

slave_disable_netpoll() is not called upon enslave failure which would
lead to a memory leak. Call slave_disable_netpoll() after err_detach as
that's the first error path after enabling netpoll on that slave.

Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller

bonding: primary_slave & curr_active_slave are not cleaned on enslave failure

2013-04-19T21:48:19+00:00

On enslave failure primary_slave can point to new_slave which is to be
freed, and the same applies to curr_active_slave. So check if this is
the case and clean up properly after err_detach because that's the first
error code path after they're set.

Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller

bonding: vlans don't get deleted on enslave failure

2013-04-19T21:48:18+00:00

The main problem is with vid refcount which only gets bumped up.
Delete the vlans after err_detach as that's the first error path
after the vlans are added.

Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller

bonding: mc addresses don't get deleted on enslave failure

2013-04-19T21:48:18+00:00

Add bond_mc_list_flush() after err_detach as that's the first error path
after the addresses are added. The main issue is the mc addresses' refcount
which only gets bumped up.

v2: update log message and don't move code unnecessarily

Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller

bonding: fix l23 and l34 load balancing in forwarding path

2013-04-18T19:07:29+00:00

Since commit 6b923cb7188d46 (bonding: support for IPv6 transmit hashing)
bonding doesn't properly hash traffic in forwarding setups.

Vitaly V. Bursov diagnosed that skb_network_header_len() returned 0 in
this case.

More generally, the transport header might not be in the skb head.

Use pskb_may_pull() & skb_header_pointer() to get it right, and use
proto_ports_offset() in bond_xmit_hash_policy_l34() to get support for
more protocols than TCP and UDP.

Reported-by: Vitaly V. Bursov 
Signed-off-by: Eric Dumazet 
Cc: Jay Vosburgh 
Cc: Andy Gospodarek 
Cc: John Eaglesham 
Tested-by: Vitaly V. Bursov 
Signed-off-by: David S. Miller

bonding: IFF_BONDING is not stripped on enslave failure

2013-04-11T20:01:47+00:00

While enslaving a new device and after IFF_BONDING flag is set, in case
of failure it is not stripped from the device's priv_flags while
cleaning up, which could lead to other problems.
Cleaning at err_close because the flag is set after dev_open().

v2: no change

Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller

bonding: fix netdev event NULL pointer dereference

2013-04-11T20:01:47+00:00

In commit 471cb5a33dcbd7c529684a2ac7ba4451414ee4a7 ("bonding: remove
usage of dev->master") a bug was introduced which causes a NULL pointer
dereference. If a bond device is in mode 6 (ALB) and a slave is added
it will dereference a NULL pointer in bond_slave_netdev_event().
This is because in bond_enslave we have bond_alb_init_slave() which
changes the MAC address of the slave and causes a NETDEV_CHANGEADDR.
Then we have in bond_slave_netdev_event():
        struct slave *slave = bond_slave_get_rtnl(slave_dev);
        struct bonding *bond = slave->bond;
bond_slave_get_rtnl() dereferences slave_dev->rx_handler_data which at
that time is NULL since netdev_rx_handler_register() is called later.

This is fixed by checking if slave is NULL before dereferencing it.

v2: Comment style changed.

Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller

bonding: fix bonding_masters race condition in bond unloading

2013-04-08T20:45:09+00:00

While the bonding module is unloading, it is considered that after
rtnl_link_unregister all bond devices are destroyed but since no
synchronization mechanism exists, a new bond device can be created
via bonding_masters before unregister_pernet_subsys which would
lead to multiple problems (e.g. NULL pointer dereference, wrong RIP,
list corruption).

This patch fixes the issue by removing any bond devices left in the
netns after bonding_masters is removed from sysfs.

Signed-off-by: Nikolay Aleksandrov 
Acked-by: Veaceslav Falico 
Signed-off-by: David S. Miller

Revert "bonding: remove sysfs before removing devices"

2013-04-08T20:45:09+00:00

This reverts commit 4de79c737b200492195ebc54a887075327e1ec1d.

This patch introduces a new bug which causes access to freed memory.
In bond_uninit: list_del(&bond->bond_list);
bond_list is linked in bond_net's dev_list which is freed by
unregister_pernet_subsys.

Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller