From: Sasha Levin <sashal@kernel•org>
To: linux-kernel@vger•kernel.org, stable@vger•kernel.org
Cc: Yufeng Mo <moyufeng@huawei•com>,
Jay Vosburgh <jay.vosburgh@canonical•com>,
"David S . Miller" <davem@davemloft•net>,
Sasha Levin <sashal@kernel•org>,
netdev@vger•kernel.org
Subject: [PATCH AUTOSEL 5.14 097/252] bonding: 3ad: fix the concurrency between __bond_release_one() and bond_3ad_state_machine_handler()
Date: Thu, 9 Sep 2021 07:38:31 -0400 [thread overview]
Message-ID: <20210909114106.141462-97-sashal@kernel.org> (raw)
In-Reply-To: <20210909114106.141462-1-sashal@kernel.org>
From: Yufeng Mo <moyufeng@huawei•com>
[ Upstream commit 220ade77452c15ecb1ab94c3f8aaeb6d033c3582 ]
Some time ago, I reported a calltrace issue
"did not find a suitable aggregator", please see[1].
After a period of analysis and reproduction, I find
that this problem is caused by concurrency.
Before the problem occurs, the bond structure is like follows:
bond0 - slaver0(eth0) - agg0.lag_ports -> port0 - port1
\
port0
\
slaver1(eth1) - agg1.lag_ports -> NULL
\
port1
If we run 'ifenslave bond0 -d eth1', the process is like below:
excuting __bond_release_one()
|
bond_upper_dev_unlink()[step1]
| | |
| | bond_3ad_lacpdu_recv()
| | ->bond_3ad_rx_indication()
| | spin_lock_bh()
| | ->ad_rx_machine()
| | ->__record_pdu()[step2]
| | spin_unlock_bh()
| | |
| bond_3ad_state_machine_handler()
| spin_lock_bh()
| ->ad_port_selection_logic()
| ->try to find free aggregator[step3]
| ->try to find suitable aggregator[step4]
| ->did not find a suitable aggregator[step5]
| spin_unlock_bh()
| |
| |
bond_3ad_unbind_slave() |
spin_lock_bh()
spin_unlock_bh()
step1: already removed slaver1(eth1) from list, but port1 remains
step2: receive a lacpdu and update port0
step3: port0 will be removed from agg0.lag_ports. The struct is
"agg0.lag_ports -> port1" now, and agg0 is not free. At the
same time, slaver1/agg1 has been removed from the list by step1.
So we can't find a free aggregator now.
step4: can't find suitable aggregator because of step2
step5: cause a calltrace since port->aggregator is NULL
To solve this concurrency problem, put bond_upper_dev_unlink()
after bond_3ad_unbind_slave(). In this way, we can invalid the port
first and skip this port in bond_3ad_state_machine_handler(). This
eliminates the situation that the slaver has been removed from the
list but the port is still valid.
[1]https://lore.kernel.org/netdev/10374.1611947473@famine/
Signed-off-by: Yufeng Mo <moyufeng@huawei•com>
Acked-by: Jay Vosburgh <jay.vosburgh@canonical•com>
Signed-off-by: David S. Miller <davem@davemloft•net>
Signed-off-by: Sasha Levin <sashal@kernel•org>
---
drivers/net/bonding/bond_main.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 31730efa7538..8aef6005bfee 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2252,7 +2252,6 @@ static int __bond_release_one(struct net_device *bond_dev,
/* recompute stats just before removing the slave */
bond_get_stats(bond->dev, &bond->bond_stats);
- bond_upper_dev_unlink(bond, slave);
/* unregister rx_handler early so bond_handle_frame wouldn't be called
* for this slave anymore.
*/
@@ -2261,6 +2260,8 @@ static int __bond_release_one(struct net_device *bond_dev,
if (BOND_MODE(bond) == BOND_MODE_8023AD)
bond_3ad_unbind_slave(slave);
+ bond_upper_dev_unlink(bond, slave);
+
if (bond_mode_can_use_xmit_hash(bond))
bond_update_slave_arr(bond, slave);
--
2.30.2
next prev parent reply other threads:[~2021-09-09 11:48 UTC|newest]
Thread overview: 71+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20210909114106.141462-1-sashal@kernel.org>
2021-09-09 11:37 ` [PATCH AUTOSEL 5.14 017/252] libbpf: Fix reuse of pinned map on older kernel Sasha Levin
2021-09-09 11:37 ` [PATCH AUTOSEL 5.14 022/252] tipc: keep the skb in rcv queue until the whole data is read Sasha Levin
2021-09-09 11:37 ` [PATCH AUTOSEL 5.14 023/252] net: phy: Fix data type in DP83822 dp8382x_disable_wol() Sasha Levin
2021-09-09 11:37 ` [PATCH AUTOSEL 5.14 025/252] iavf: do not override the adapter state in the watchdog task Sasha Levin
2021-09-09 11:37 ` [PATCH AUTOSEL 5.14 026/252] iavf: fix locking of critical sections Sasha Levin
2021-09-09 11:37 ` [PATCH AUTOSEL 5.14 030/252] netlink: Deal with ESRCH error in nlmsg_notify() Sasha Levin
2021-09-09 11:37 ` [PATCH AUTOSEL 5.14 032/252] net: ipa: fix IPA v4.11 interconnect data Sasha Levin
2021-09-09 11:37 ` [PATCH AUTOSEL 5.14 038/252] igc: Check if num of q_vectors is smaller than max before array access Sasha Levin
2021-09-09 11:37 ` [PATCH AUTOSEL 5.14 057/252] nfp: fix return statement in nfp_net_parse_meta() Sasha Levin
2021-09-09 11:37 ` [PATCH AUTOSEL 5.14 060/252] ethtool: improve compat ioctl handling Sasha Levin
2021-09-09 11:37 ` [PATCH AUTOSEL 5.14 064/252] bpf/tests: Fix copy-and-paste error in double word test Sasha Levin
2021-09-09 11:37 ` [PATCH AUTOSEL 5.14 065/252] bpf/tests: Do not PASS tests without actually testing the result Sasha Levin
2021-09-09 11:38 ` [PATCH AUTOSEL 5.14 071/252] net: ipa: fix ipa_cmd_table_valid() Sasha Levin
2021-09-09 11:38 ` [PATCH AUTOSEL 5.14 072/252] net: ipa: always validate filter and route tables Sasha Levin
2021-09-09 11:38 ` [PATCH AUTOSEL 5.14 073/252] ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs() Sasha Levin
2021-09-09 11:38 ` [PATCH AUTOSEL 5.14 074/252] flow_dissector: Fix out-of-bounds warnings Sasha Levin
2021-09-09 11:38 ` [PATCH AUTOSEL 5.14 085/252] samples: bpf: Fix tracex7 error raised on the missing argument Sasha Levin
2021-09-09 11:38 ` [PATCH AUTOSEL 5.14 086/252] libbpf: Fix race when pinning maps in parallel Sasha Levin
2021-09-09 11:38 ` [PATCH AUTOSEL 5.14 090/252] Bluetooth: skip invalid hci_sync_conn_complete_evt Sasha Levin
2021-09-09 11:38 ` [PATCH AUTOSEL 5.14 096/252] netfilter: nft_compat: use nfnetlink_unicast() Sasha Levin
2021-09-09 11:38 ` Sasha Levin [this message]
2021-09-09 11:38 ` [PATCH AUTOSEL 5.14 101/252] bpf: Fix off-by-one in tail call count limiting Sasha Levin
2021-09-14 4:08 ` Johan Almbladh
2021-09-09 11:38 ` [PATCH AUTOSEL 5.14 103/252] Bluetooth: Fix not generating RPA when required Sasha Levin
2021-09-09 11:38 ` [PATCH AUTOSEL 5.14 104/252] dpaa2-switch: do not enable the DPSW at probe time Sasha Levin
2021-09-09 11:38 ` [PATCH AUTOSEL 5.14 114/252] net: ipa: fix IPA v4.9 interconnects Sasha Levin
2021-09-09 11:39 ` [PATCH AUTOSEL 5.14 126/252] net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe() Sasha Levin
2021-09-09 11:39 ` [PATCH AUTOSEL 5.14 137/252] selftests/bpf: Fix xdp_tx.c prog section name Sasha Levin
2021-09-09 11:39 ` [PATCH AUTOSEL 5.14 140/252] Bluetooth: schedule SCO timeouts with delayed_work Sasha Levin
2021-09-09 11:39 ` [PATCH AUTOSEL 5.14 141/252] Bluetooth: avoid circular locks in sco_sock_connect Sasha Levin
2021-09-09 11:39 ` [PATCH AUTOSEL 5.14 146/252] net/mlx5: Fix variable type to match 64bit Sasha Levin
2021-09-09 11:39 ` [PATCH AUTOSEL 5.14 149/252] mac80211: Fix monitor MTU limit so that A-MSDUs get through Sasha Levin
2021-09-09 11:39 ` [PATCH AUTOSEL 5.14 160/252] Bluetooth: Fix handling of LE Enhanced Connection Complete Sasha Levin
2021-09-09 11:39 ` [PATCH AUTOSEL 5.14 161/252] Bluetooth: Fix race condition in handling NOP command Sasha Levin
2021-09-09 11:39 ` [PATCH AUTOSEL 5.14 165/252] tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD Sasha Levin
2021-09-09 11:39 ` [PATCH AUTOSEL 5.14 168/252] rpc: fix gss_svc_init cleanup on failure Sasha Levin
2021-09-09 11:39 ` [PATCH AUTOSEL 5.14 169/252] iavf: use mutexes for locking of critical sections Sasha Levin
2021-09-09 11:39 ` [PATCH AUTOSEL 5.14 170/252] selftests/bpf: Correctly display subtest skip status Sasha Levin
2021-09-09 11:39 ` [PATCH AUTOSEL 5.14 171/252] selftests/bpf: Fix flaky send_signal test Sasha Levin
2021-09-09 11:39 ` [PATCH AUTOSEL 5.14 174/252] selftests: nci: Fix the code for next nlattr offset Sasha Levin
2021-09-09 11:39 ` [PATCH AUTOSEL 5.14 175/252] selftests: nci: Fix the wrong condition Sasha Levin
2021-09-09 11:39 ` [PATCH AUTOSEL 5.14 176/252] net: Fix offloading indirect devices dependency on qdisc order creation Sasha Levin
2021-09-09 11:39 ` [PATCH AUTOSEL 5.14 184/252] rtl8xxxu: Fix the handling of TX A-MPDU aggregation Sasha Levin
2021-09-09 11:39 ` [PATCH AUTOSEL 5.14 185/252] rtw88: use read_poll_timeout instead of fixed sleep Sasha Levin
2021-09-09 11:40 ` [PATCH AUTOSEL 5.14 186/252] rtw88: wow: build wow function only if CONFIG_PM is on Sasha Levin
2021-09-09 11:40 ` [PATCH AUTOSEL 5.14 187/252] rtw88: wow: fix size access error of probe request Sasha Levin
2021-09-09 11:40 ` [PATCH AUTOSEL 5.14 188/252] octeontx2-pf: Fix NIX1_RX interface backpressure Sasha Levin
2021-09-09 11:40 ` [PATCH AUTOSEL 5.14 209/252] mptcp: fix ADD_ADDR and RM_ADDR maybe flush addr_signal each other Sasha Levin
2021-09-09 22:33 ` Mat Martineau
2021-09-11 14:37 ` Sasha Levin
2021-09-09 11:40 ` [PATCH AUTOSEL 5.14 210/252] selftests/bpf: Enlarge select() timeout for test_maps Sasha Levin
2021-09-09 11:40 ` [PATCH AUTOSEL 5.14 212/252] octeontx2-pf: cleanup transmit link deriving logic Sasha Levin
2021-09-09 11:40 ` [PATCH AUTOSEL 5.14 228/252] iwlwifi: pcie: free RBs during configure Sasha Levin
2021-09-09 11:40 ` [PATCH AUTOSEL 5.14 229/252] iwlwifi: mvm: Do not use full SSIDs in 6GHz scan Sasha Levin
2021-09-09 11:40 ` [PATCH AUTOSEL 5.14 230/252] iwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed Sasha Levin
2021-09-09 11:40 ` [PATCH AUTOSEL 5.14 231/252] iwlwifi: mvm: avoid static queue number aliasing Sasha Levin
2021-09-09 11:40 ` [PATCH AUTOSEL 5.14 232/252] iwlwifi: mvm: Fix umac scan request probe parameters Sasha Levin
2021-09-09 11:40 ` [PATCH AUTOSEL 5.14 233/252] iwlwifi: mvm: fix access to BSS elements Sasha Levin
2021-09-09 11:40 ` [PATCH AUTOSEL 5.14 234/252] iwlwifi: fw: correctly limit to monitor dump Sasha Levin
2021-09-09 11:40 ` [PATCH AUTOSEL 5.14 235/252] iwlwifi: mvm: don't schedule the roc_done_wk if it is already running Sasha Levin
2021-09-09 11:40 ` [PATCH AUTOSEL 5.14 236/252] iwlwifi: mvm: Fix scan channel flags settings Sasha Levin
2021-09-09 11:40 ` [PATCH AUTOSEL 5.14 237/252] net/mlx5: DR, fix a potential use-after-free bug Sasha Levin
2021-09-09 11:40 ` [PATCH AUTOSEL 5.14 238/252] net/mlx5: DR, Enable QP retransmission Sasha Levin
2021-09-09 11:40 ` [PATCH AUTOSEL 5.14 245/252] selftests/bpf: Fix potential unreleased lock Sasha Levin
2021-09-09 11:41 ` [PATCH AUTOSEL 5.14 246/252] wcn36xx: Fix missing frame timestamp for beacon/probe-resp Sasha Levin
2021-09-09 11:41 ` [PATCH AUTOSEL 5.14 247/252] ath9k: fix OOB read ar9300_eeprom_restore_internal Sasha Levin
2021-09-09 11:41 ` [PATCH AUTOSEL 5.14 248/252] ath9k: fix sleeping in atomic context Sasha Levin
2021-09-09 11:41 ` [PATCH AUTOSEL 5.14 249/252] net: fix NULL pointer reference in cipso_v4_doi_free Sasha Levin
2021-09-09 11:41 ` [PATCH AUTOSEL 5.14 250/252] fix array-index-out-of-bounds in taprio_change Sasha Levin
2021-09-09 11:41 ` [PATCH AUTOSEL 5.14 251/252] net: w5100: check return value after calling platform_get_resource() Sasha Levin
2021-09-09 11:41 ` [PATCH AUTOSEL 5.14 252/252] net: hns3: clean up a type mismatch warning Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210909114106.141462-97-sashal@kernel.org \
--to=sashal@kernel$(echo .)org \
--cc=davem@davemloft$(echo .)net \
--cc=jay.vosburgh@canonical$(echo .)com \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=moyufeng@huawei$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=stable@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox