From: Stephen Hemminger <shemminger@vyatta•com>
To: "Nicolas de Pesloüan" <nicolas.2p.debian@gmail•com>
Cc: David Miller <davem@davemloft•net>,
Jay Vosburgh <fubar@us•ibm.com>,
Andy Gospodarek <andy@greyhouse•net>,
netdev@vger•kernel.org
Subject: [PATCH] bonding: fix error handling if slave is busy (v2)
Date: Sat, 31 Dec 2011 15:26:46 -0800 [thread overview]
Message-ID: <20111231152646.6f0f98fc@nehalam.linuxnetplumber.net> (raw)
In-Reply-To: <4EFF3419.4050504@gmail.com>
If slave device already has a receive handler registered, then the
error unwind of bonding device enslave function is broken.
The following will leave a pointer to freed memory in the slave
device list, causing a later kernel panic.
# modprobe dummy
# ip li add dummy0-1 link dummy0 type macvlan
# modprobe bonding
# echo +dummy0 >/sys/class/net/bond0/bonding/slaves
The fix is to detach the slave (which removes it from the list)
in the unwind path.
Signed-off-by: Stephen Hemminger <shemminger@vyatta•com>
---
v2 - need to keep original err_close for other unwind
--- a/drivers/net/bonding/bond_main.c 2011-12-30 14:20:03.171823181 -0800
+++ b/drivers/net/bonding/bond_main.c 2011-12-31 15:20:16.493379415 -0800
@@ -1822,7 +1822,7 @@ int bond_enslave(struct net_device *bond
"but new slave device does not support netpoll.\n",
bond_dev->name);
res = -EBUSY;
- goto err_close;
+ goto err_detach;
}
}
#endif
@@ -1831,7 +1831,7 @@ int bond_enslave(struct net_device *bond
res = bond_create_slave_symlinks(bond_dev, slave_dev);
if (res)
- goto err_close;
+ goto err_detach;
res = netdev_rx_handler_register(slave_dev, bond_handle_frame,
new_slave);
@@ -1852,6 +1852,11 @@ int bond_enslave(struct net_device *bond
err_dest_symlinks:
bond_destroy_slave_symlinks(bond_dev, slave_dev);
+err_detach:
+ write_lock_bh(&bond->lock);
+ bond_detach_slave(bond, new_slave);
+ write_unlock_bh(&bond->lock);
+
err_close:
dev_close(slave_dev);
next prev parent reply other threads:[~2011-12-31 23:26 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-12-30 22:40 [PATCH] bonding: fix error handling if slave is busy Stephen Hemminger
2011-12-31 16:11 ` Nicolas de Pesloüan
2011-12-31 23:26 ` Stephen Hemminger [this message]
2012-01-01 0:09 ` [PATCH] bonding: fix error handling if slave is busy (v2) Nicolas de Pesloüan
2012-01-01 0:13 ` Stephen Hemminger
2012-01-01 0:28 ` Nicolas de Pesloüan
2012-01-03 17:49 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20111231152646.6f0f98fc@nehalam.linuxnetplumber.net \
--to=shemminger@vyatta$(echo .)com \
--cc=andy@greyhouse$(echo .)net \
--cc=davem@davemloft$(echo .)net \
--cc=fubar@us$(echo .)ibm.com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=nicolas.2p.debian@gmail$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox