Subject: Re: [PATCH net v2] bonding: hold ops lock around get_link

From: Jay Vosburgh <[email-masked]>
Date: Mon, 28 Apr 2025 08:10:40 -0700

Hangbin Liu <[email-masked]> wrote:

>On Sun, Apr 27, 2025 at 11:06:32AM +0800, Wang Liang wrote:
>> 
>> 在 2025/4/11 0:11, Stanislav Fomichev 写道:
>> > syzbot reports a case of ethtool_ops->get_link being called without
>> > ops lock:
>> > 
>> >   ethtool_op_get_link+0x15/0x60 net/ethtool/ioctl.c:63
>> >   bond_check_dev_link+0x1fb/0x4b0 drivers/net/bonding/bond_main.c:864
>> >   bond_miimon_inspect drivers/net/bonding/bond_main.c:2734 [inline]
>> >   bond_mii_monitor+0x49d/0x3170 drivers/net/bonding/bond_main.c:2956
>> >   process_one_work kernel/workqueue.c:3238 [inline]
>> >   process_scheduled_works+0xac3/0x18e0 kernel/workqueue.c:3319
>> >   worker_thread+0x870/0xd50 kernel/workqueue.c:3400
>> >   kthread+0x7b7/0x940 kernel/kthread.c:464
>> >   ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
>> >   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>> > 
>> > Commit 04efcee6ef8d ("net: hold instance lock during NETDEV_CHANGE")
>> > changed to lockless __linkwatch_sync_dev in ethtool_op_get_link.
>> > All paths except bonding are coming via locked ioctl. Add necessary
>> > locking to bonding.
>> > 
>> > Reviewed-by: Hangbin Liu <[email-masked]>
>> > Reported-by: [email-masked]
>> > Closes: https://syzkaller.appspot.com/bug?extid=48c14f61594bdfadb086
>> > Fixes: 04efcee6ef8d ("net: hold instance lock during NETDEV_CHANGE")
>> > Signed-off-by: Stanislav Fomichev <[email-masked]>
>> > ---
>> > v2:
>> > - move 'BMSR_LSTATUS : 0' part out (Jakub)
>> > ---
>> >   drivers/net/bonding/bond_main.c | 13 +++++++++----
>> >   1 file changed, 9 insertions(+), 4 deletions(-)
>> > 
>> > diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
>> > index 950d8e4d86f8..8ea183da8d53 100644
>> > --- a/drivers/net/bonding/bond_main.c
>> > +++ b/drivers/net/bonding/bond_main.c
>> > @@ -850,8 +850,9 @@ static int bond_check_dev_link(struct bonding *bond,
>> >   			       struct net_device *slave_dev, int reporting)
>> >   {
>> >   	const struct net_device_ops *slave_ops = slave_dev->netdev_ops;
>> > -	struct ifreq ifr;
>> >   	struct mii_ioctl_data *mii;
>> > +	struct ifreq ifr;
>> > +	int ret;
>> >   	if (!reporting && !netif_running(slave_dev))
>> >   		return 0;
>> > @@ -860,9 +861,13 @@ static int bond_check_dev_link(struct bonding *bond,
>> >   		return netif_carrier_ok(slave_dev) ? BMSR_LSTATUS : 0;
>> >   	/* Try to get link status using Ethtool first. */
>> > -	if (slave_dev->ethtool_ops->get_link)
>> > -		return slave_dev->ethtool_ops->get_link(slave_dev) ?
>> > -			BMSR_LSTATUS : 0;
>> > +	if (slave_dev->ethtool_ops->get_link) {
>> > +		netdev_lock_ops(slave_dev);
>> > +		ret = slave_dev->ethtool_ops->get_link(slave_dev);
>> > +		netdev_unlock_ops(slave_dev);
>> > +
>> > +		return ret ? BMSR_LSTATUS : 0;
>> > +	}
>> >   	/* Ethtool can't be used, fallback to MII ioctls. */
>> >   	if (slave_ops->ndo_eth_ioctl) {
>> 
>> 
>> Hello, I find that a WARNING still exists:
>> 
>>   RTNL: assertion failed at ./include/net/netdev_lock.h (56)
>>   WARNING: CPU: 1 PID: 3020 at ./include/net/netdev_lock.h:56
>> netdev_ops_assert_locked include/net/netdev_lock.h:56 [inline]
>>   WARNING: CPU: 1 PID: 3020 at ./include/net/netdev_lock.h:56
>> __linkwatch_sync_dev+0x30d/0x360 net/core/link_watch.c:279
>>   Modules linked in:
>>   CPU: 1 UID: 0 PID: 3020 Comm: kworker/u8:10 Not tainted
>> 6.15.0-rc2-syzkaller-00257-gb5c6891b2c5b #0 PREEMPT(full)
>>   Hardware name: Google Compute Engine, BIOS Google 02/12/2025
>>   Workqueue: bond0 bond_mii_monitor
>>   RIP: 0010:netdev_ops_assert_locked include/net/netdev_lock.h:56 [inline]
>> 
>> It is report by syzbot (link:
>> https://syzkaller.appspot.com/bug?extid=48c14f61594bdfadb086).
>> 
>> Because ASSERT_RTNL() failed in netdev_ops_assert_locked().
>> 
>> I wonder if should add rtnl lock in bond_check_dev_link()?
>> 
>> Like this:
>> 
>>   +++ b/drivers/net/bonding/bond_main.c
>>   @@ -862,10 +862,12 @@  static int bond_check_dev_link(struct bonding
>> *bond,
>> 
>>        /* Try to get link status using Ethtool first. */
>>        if (slave_dev->ethtool_ops->get_link) {
>>   -        netdev_lock_ops(slave_dev);
>>   -        ret = slave_dev->ethtool_ops->get_link(slave_dev);
>>   -        netdev_unlock_ops(slave_dev);
>>   -
>>   +        if (rtnl_trylock()) {
>>   +            netdev_lock_ops(slave_dev);
>>   +            ret = slave_dev->ethtool_ops->get_link(slave_dev);
>>   +            netdev_unlock_ops(slave_dev);
>>   +            rtnl_unlock();
>>   +        }
>>            return ret ? BMSR_LSTATUS : 0;
>>        }
>> 
>
>What if rtnl_trylock() failed? This will return ret directly.
>Maybe
>	if (slave_dev->ethtool_ops->get_link && rtnl_trylock()) {
>		netdev_lock_ops(slave_dev);
>		ret = slave_dev->ethtool_ops->get_link(slave_dev);
>		netdev_unlock_ops(slave_dev);
>		rtnl_unlock();
>		return ret ? BMSR_LSTATUS : 0;
>	}

	This is on me; I had worked up a patch to remove all of this
logic entirely and deprecate use_carrier, but got sidetracked.  Let me
rebase it and repost it for real.

	For reference, the original patch is below; it still needs an
update to Documentation/networking/bonding.rst.

Subject: [PATCH RFC net-next] bonding: Remove support for use_carrier

	 Remove the implementation of use_carrier, the link monitoring
method that utilizes ethtool or ioctl to determine the link state of an
interface in a bond.  The ability to set or query the use_carrier option
remains, but bonding now always behaves as if use_carrier=1, which relies
on netif_carrier_ok() to determine the link state of interfaces.

	To avoid acquiring RTNL many times per second, bonding inspects
link state under RCU, but not under RTNL.  However, ethtool
implementations in drivers may sleep, and therefore this strategy is
unsuitable for use with calls into driver ethtool functions.

	The use_carrier option was introduced in 2003, to provide
backwards compatibility for network device drivers that did not support
the then-new netif_carrier_ok/on/off system.  Device drivers are now
expected to support netif_carrier_*, and the use_carrier backwards
compatibility logic is no longer necessary.

Link: https://lore.kernel.org/lkml/[email-masked]/
Link: https://lore.kernel.org/netdev/20240718122017.d2e33aaac43a.I10ab9c9ded97163aef4e4de10985cd8f7de60d28@changeid/
Signed-off-by: Jay Vosburgh <[email-masked]>

---
 drivers/net/bonding/bond_main.c    | 107 +----------------------------
 drivers/net/bonding/bond_netlink.c |  11 +--
 drivers/net/bonding/bond_options.c |  13 +---
 drivers/net/bonding/bond_sysfs.c   |   6 +-
 include/net/bonding.h              |   1 -
 5 files changed, 7 insertions(+), 131 deletions(-)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index af9ddd3902cc..98d77a9e5cf1 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -141,8 +141,7 @@ module_param(downdelay, int, 0);
 MODULE_PARM_DESC(downdelay, "Delay before considering link down, "
 			    "in milliseconds");
 module_param(use_carrier, int, 0);
-MODULE_PARM_DESC(use_carrier, "Use netif_carrier_ok (vs MII ioctls) in miimon; "
-			      "0 for off, 1 for on (default)");
+MODULE_PARM_DESC(use_carrier, "Obsolete, has no effect");
 module_param(mode, charp, 0);
 MODULE_PARM_DESC(mode, "Mode of operation; 0 for balance-rr, "
 		       "1 for active-backup, 2 for balance-xor, "
@@ -723,73 +722,6 @@ const char *bond_slave_link_status(s8 link)
 	}
 }
 
-/* if <dev> supports MII link status reporting, check its link status.
- *
- * We either do MII/ETHTOOL ioctls, or check netif_carrier_ok(),
- * depending upon the setting of the use_carrier parameter.
- *
- * Return either BMSR_LSTATUS, meaning that the link is up (or we
- * can't tell and just pretend it is), or 0, meaning that the link is
- * down.
- *
- * If reporting is non-zero, instead of faking link up, return -1 if
- * both ETHTOOL and MII ioctls fail (meaning the device does not
- * support them).  If use_carrier is set, return whatever it says.
- * It'd be nice if there was a good way to tell if a driver supports
- * netif_carrier, but there really isn't.
- */
-static int bond_check_dev_link(struct bonding *bond,
-			       struct net_device *slave_dev, int reporting)
-{
-	const struct net_device_ops *slave_ops = slave_dev->netdev_ops;
-	int (*ioctl)(struct net_device *, struct ifreq *, int);
-	struct ifreq ifr;
-	struct mii_ioctl_data *mii;
-
-	if (!reporting && !netif_running(slave_dev))
-		return 0;
-
-	if (bond->params.use_carrier)
-		return netif_carrier_ok(slave_dev) ? BMSR_LSTATUS : 0;
-
-	/* Try to get link status using Ethtool first. */
-	if (slave_dev->ethtool_ops->get_link)
-		return slave_dev->ethtool_ops->get_link(slave_dev) ?
-			BMSR_LSTATUS : 0;
-
-	/* Ethtool can't be used, fallback to MII ioctls. */
-	ioctl = slave_ops->ndo_eth_ioctl;
-	if (ioctl) {
-		/* TODO: set pointer to correct ioctl on a per team member
-		 *       bases to make this more efficient. that is, once
-		 *       we determine the correct ioctl, we will always
-		 *       call it and not the others for that team
-		 *       member.
-		 */
-
-		/* We cannot assume that SIOCGMIIPHY will also read a
-		 * register; not all network drivers (e.g., e100)
-		 * support that.
-		 */
-
-		/* Yes, the mii is overlaid on the ifreq.ifr_ifru */
-		strscpy_pad(ifr.ifr_name, slave_dev->name, IFNAMSIZ);
-		mii = if_mii(&ifr);
-		if (ioctl(slave_dev, &ifr, SIOCGMIIPHY) == 0) {
-			mii->reg_num = MII_BMSR;
-			if (ioctl(slave_dev, &ifr, SIOCGMIIREG) == 0)
-				return mii->val_out & BMSR_LSTATUS;
-		}
-	}
-
-	/* If reporting, report that either there's no ndo_eth_ioctl,
-	 * or both SIOCGMIIREG and get_link failed (meaning that we
-	 * cannot report link status).  If not reporting, pretend
-	 * we're ok.
-	 */
-	return reporting ? -1 : BMSR_LSTATUS;
-}
-
 /*----------------------------- Multicast list ------------------------------*/
 
 /* Push the promiscuity flag down to appropriate slaves */
@@ -1832,7 +1764,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
 	const struct net_device_ops *slave_ops = slave_dev->netdev_ops;
 	struct slave *new_slave = NULL, *prev_slave;
 	struct sockaddr_storage ss;
-	int link_reporting;
 	int res = 0, i;
 
 	if (slave_dev->flags & IFF_MASTER &&
@@ -1842,12 +1773,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
 		return -EPERM;
 	}
 
-	if (!bond->params.use_carrier &&
-	    slave_dev->ethtool_ops->get_link == NULL &&
-	    slave_ops->ndo_eth_ioctl == NULL) {
-		slave_warn(bond_dev, slave_dev, "no link monitoring support\n");
-	}
-
 	/* already in-use? */
 	if (netdev_is_rx_handler_busy(slave_dev)) {
 		SLAVE_NL_ERR(bond_dev, slave_dev, extack,
@@ -2050,29 +1975,10 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
 
 	new_slave->last_tx = new_slave->last_rx;
 
-	if (bond->params.miimon && !bond->params.use_carrier) {
-		link_reporting = bond_check_dev_link(bond, slave_dev, 1);
-
-		if ((link_reporting == -1) && !bond->params.arp_interval) {
-			/* miimon is set but a bonded network driver
-			 * does not support ETHTOOL/MII and
-			 * arp_interval is not set.  Note: if
-			 * use_carrier is enabled, we will never go
-			 * here (because netif_carrier is always
-			 * supported); thus, we don't need to change
-			 * the messages for netif_carrier.
-			 */
-			slave_warn(bond_dev, slave_dev, "MII and ETHTOOL support not available for slave, and arp_interval/arp_ip_target module parameters not specified, thus bonding will not detect link failures! see bonding.txt for details\n");
-		} else if (link_reporting == -1) {
-			/* unable get link status using mii/ethtool */
-			slave_warn(bond_dev, slave_dev, "can't get link status from slave; the network driver associated with this interface does not support MII or ETHTOOL link status reporting, thus miimon has no effect on this interface\n");
-		}
-	}
-
 	/* check for initial state */
 	new_slave->link = BOND_LINK_NOCHANGE;
 	if (bond->params.miimon) {
-		if (bond_check_dev_link(bond, slave_dev, 0) == BMSR_LSTATUS) {
+		if (netif_carrier_ok(slave_dev)) {
 			if (bond->params.updelay) {
 				bond_set_slave_link_state(new_slave,
 							  BOND_LINK_BACK,
@@ -2601,7 +2507,7 @@ static int bond_miimon_inspect(struct bonding *bond)
 	bond_for_each_slave_rcu(bond, slave, iter) {
 		bond_propose_link_state(slave, BOND_LINK_NOCHANGE);
 
-		link_state = bond_check_dev_link(bond, slave->dev, 0);
+		link_state = netif_carrier_ok(slave->dev);
 
 		switch (slave->link) {
 		case BOND_LINK_UP:
@@ -6044,12 +5950,6 @@ static int __init bond_check_params(struct bond_params *params)
 		downdelay = 0;
 	}
 
-	if ((use_carrier != 0) && (use_carrier != 1)) {
-		pr_warn("Warning: use_carrier module parameter (%d), not of valid value (0/1), so it was set to 1\n",
-			use_carrier);
-		use_carrier = 1;
-	}
-
 	if (num_peer_notif < 0 || num_peer_notif > 255) {
 		pr_warn("Warning: num_grat_arp/num_unsol_na (%d) not in range 0-255 so it was reset to 1\n",
 			num_peer_notif);
@@ -6294,7 +6194,6 @@ static int __init bond_check_params(struct bond_params *params)
 	params->updelay = updelay;
 	params->downdelay = downdelay;
 	params->peer_notif_delay = 0;
-	params->use_carrier = use_carrier;
 	params->lacp_active = 1;
 	params->lacp_fast = lacp_fast;
 	params->primary[0] = 0;
diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
index 2a6a424806aa..e35433cd76b1 100644
--- a/drivers/net/bonding/bond_netlink.c
+++ b/drivers/net/bonding/bond_netlink.c
@@ -257,15 +257,6 @@ static int bond_changelink(struct net_device *bond_dev, struct nlattr *tb[],
 		if (err)
 			return err;
 	}
-	if (data[IFLA_BOND_USE_CARRIER]) {
-		int use_carrier = nla_get_u8(data[IFLA_BOND_USE_CARRIER]);
-
-		bond_opt_initval(&newval, use_carrier);
-		err = __bond_opt_set(bond, BOND_OPT_USE_CARRIER, &newval,
-				     data[IFLA_BOND_USE_CARRIER], extack);
-		if (err)
-			return err;
-	}
 	if (data[IFLA_BOND_ARP_INTERVAL]) {
 		int arp_interval = nla_get_u32(data[IFLA_BOND_ARP_INTERVAL]);
 
@@ -674,7 +665,7 @@ static int bond_fill_info(struct sk_buff *skb,
 			bond->params.peer_notif_delay * bond->params.miimon))
 		goto nla_put_failure;
 
-	if (nla_put_u8(skb, IFLA_BOND_USE_CARRIER, bond->params.use_carrier))
+	if (nla_put_u8(skb, IFLA_BOND_USE_CARRIER, 1))
 		goto nla_put_failure;
 
 	if (nla_put_u32(skb, IFLA_BOND_ARP_INTERVAL, bond->params.arp_interval))
diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
index bc80fb6397dc..ab5db55e27ea 100644
--- a/drivers/net/bonding/bond_options.c
+++ b/drivers/net/bonding/bond_options.c
@@ -183,12 +183,6 @@ static const struct bond_opt_value bond_primary_reselect_tbl[] = {
 	{ NULL,      -1},
 };
 
-static const struct bond_opt_value bond_use_carrier_tbl[] = {
-	{ "off", 0,  0},
-	{ "on",  1,  BOND_VALFLAG_DEFAULT},
-	{ NULL,  -1, 0}
-};
-
 static const struct bond_opt_value bond_all_slaves_active_tbl[] = {
 	{ "off", 0,  BOND_VALFLAG_DEFAULT},
 	{ "on",  1,  0},
@@ -410,8 +404,7 @@ static const struct bond_option bond_opts[BOND_OPT_LAST] = {
 	[BOND_OPT_USE_CARRIER] = {
 		.id = BOND_OPT_USE_CARRIER,
 		.name = "use_carrier",
-		.desc = "Use netif_carrier_ok (vs MII ioctls) in miimon",
-		.values = bond_use_carrier_tbl,
+		.desc = "Obsolete, has no effect",
 		.set = bond_option_use_carrier_set
 	},
 	[BOND_OPT_ACTIVE_SLAVE] = {
@@ -1064,10 +1057,6 @@ static int bond_option_peer_notif_delay_set(struct bonding *bond,
 static int bond_option_use_carrier_set(struct bonding *bond,
 				       const struct bond_opt_value *newval)
 {
-	netdev_dbg(bond->dev, "Setting use_carrier to %llu\n",
-		   newval->value);
-	bond->params.use_carrier = newval->value;
-
 	return 0;
 }
 
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 1e13bb170515..9a75ad3181ab 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -467,14 +467,12 @@ static ssize_t bonding_show_primary_reselect(struct device *d,
 static DEVICE_ATTR(primary_reselect, 0644,
 		   bonding_show_primary_reselect, bonding_sysfs_store_option);
 
-/* Show the use_carrier flag. */
+/* use_carrier is obsolete, but print value for compatibility */
 static ssize_t bonding_show_carrier(struct device *d,
 				    struct device_attribute *attr,
 				    char *buf)
 {
-	struct bonding *bond = to_bond(d);
-
-	return sysfs_emit(buf, "%d\n", bond->params.use_carrier);
+	return sysfs_emit(buf, "1\n");
 }
 static DEVICE_ATTR(use_carrier, 0644,
 		   bonding_show_carrier, bonding_sysfs_store_option);
diff --git a/include/net/bonding.h b/include/net/bonding.h
index b61fb1aa3a56..2977a9bc343b 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -124,7 +124,6 @@ struct bond_params {
 	int arp_interval;
 	int arp_validate;
 	int arp_all_targets;
-	int use_carrier;
 	int fail_over_mac;
 	int updelay;
 	int downdelay;
-- 
2.34.1

---
	-Jay Vosburgh, [email-masked]