From: Jakub Kicinski <kuba@kernel•org>
To: Taehee Yoo <ap420073@gmail•com>
Cc: davem@davemloft•net, pabeni@redhat•com, edumazet@google•com,
jiri@resnulli•us, j.vosburgh@gmail•com, andy@greyhouse•net,
netdev@vger•kernel.org, jarod@redhat•com, razor@blackwall•org,
simon.horman@corigine•com, wangyufen@huawei•com,
syzbot+60748c96cf5c6df8e581@syzkaller•appspotmail.com
Subject: Re: [PATCH net v2] net: fix stack overflow when LRO is disabled for virtual interfaces
Date: Wed, 17 May 2023 09:15:11 -0700 [thread overview]
Message-ID: <20230517091511.30cc0803@kernel.org> (raw)
In-Reply-To: <20230517143010.3596250-1-ap420073@gmail.com>
On Wed, 17 May 2023 14:30:10 +0000 Taehee Yoo wrote:
> When the virtual interface's feature is updated, it synchronizes the
> updated feature for its own lower interface.
> This propagation logic should be worked as the iteration, not recursively.
> But it works recursively due to the netdev notification unexpectedly.
> This problem occurs when it disables LRO only for the team and bonding
> interface type.
>
> team0
> |
> +------+------+-----+-----+
> | | | | |
> team1 team2 team3 ... team200
>
> If team0's LRO feature is updated, it generates the NETDEV_FEAT_CHANGE
> event to its own lower interfaces(team1 ~ team200).
> It is worked by netdev_sync_lower_features().
> So, the NETDEV_FEAT_CHANGE notification logic of each lower interface
> work iteratively.
> But generated NETDEV_FEAT_CHANGE event is also sent to the upper
> interface too.
> upper interface(team0) generates the NETDEV_FEAT_CHANGE event for its own
> lower interfaces again.
> lower and upper interfaces receive this event and generate this
> event again and again.
> So, the stack overflow occurs.
>
> But it is not the infinite loop issue.
> Because the netdev_sync_lower_features() updates features before
> generating the NETDEV_FEAT_CHANGE event.
> Already synchronized lower interfaces skip notification logic.
Why doesn't the (already synchronized) upper not skip the update?
> So, it is just the problem that iteration logic is changed to the
> recursive unexpectedly due to the notification mechanism.
>
> Reproducer:
>
> ip link add team0 type team
> ethtool -K team0 lro on
> for i in {1..200}
> do
> ip link add team$i master team0 type team
> ethtool -K team$i lro on
> done
>
> ethtool -K team0 lro off
>
> In order to fix it, the notifier_ctx member of bonding/team is introduced.
next prev parent reply other threads:[~2023-05-17 16:15 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-05-17 14:30 [PATCH net v2] net: fix stack overflow when LRO is disabled for virtual interfaces Taehee Yoo
2023-05-17 14:59 ` Eric Dumazet
2023-05-17 15:02 ` Nikolay Aleksandrov
2023-05-17 16:15 ` Jakub Kicinski [this message]
2023-05-17 17:28 ` Taehee Yoo
2023-05-17 18:45 ` Jakub Kicinski
2023-05-19 6:25 ` Taehee Yoo
2023-05-19 21:31 ` Jakub Kicinski
2023-05-20 5:50 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230517091511.30cc0803@kernel.org \
--to=kuba@kernel$(echo .)org \
--cc=andy@greyhouse$(echo .)net \
--cc=ap420073@gmail$(echo .)com \
--cc=davem@davemloft$(echo .)net \
--cc=edumazet@google$(echo .)com \
--cc=j.vosburgh@gmail$(echo .)com \
--cc=jarod@redhat$(echo .)com \
--cc=jiri@resnulli$(echo .)us \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=razor@blackwall$(echo .)org \
--cc=simon.horman@corigine$(echo .)com \
--cc=syzbot+60748c96cf5c6df8e581@syzkaller$(echo .)appspotmail.com \
--cc=wangyufen@huawei$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox