From patchwork Fri Jun 4 02:14:20 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "zhudi (J)" X-Patchwork-Id: 12298607 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8607DC47097 for ; Fri, 4 Jun 2021 02:14:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4F864613B4 for ; Fri, 4 Jun 2021 02:14:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230030AbhFDCQR (ORCPT ); Thu, 3 Jun 2021 22:16:17 -0400 Received: from szxga03-in.huawei.com ([45.249.212.189]:4343 "EHLO szxga03-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229758AbhFDCQP (ORCPT ); Thu, 3 Jun 2021 22:16:15 -0400 Received: from dggemv703-chm.china.huawei.com (unknown [172.30.72.54]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4Fx5pB0KByz67vD; Fri, 4 Jun 2021 10:10:42 +0800 (CST) Received: from dggpemm500021.china.huawei.com (7.185.36.109) by dggemv703-chm.china.huawei.com (10.3.19.46) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2176.2; Fri, 4 Jun 2021 10:14:28 +0800 Received: from DESKTOP-9883QJJ.china.huawei.com (10.136.114.155) by dggpemm500021.china.huawei.com (7.185.36.109) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2176.2; Fri, 4 Jun 2021 10:14:27 +0800 From: zhudi To: , , , CC: , , Subject: [PATCH v2] bonding: 3ad: fix a crash in agg_device_up() Date: Fri, 4 Jun 2021 10:14:20 +0800 Message-ID: <20210604021420.49972-1-zhudi21@huawei.com> X-Mailer: git-send-email 2.27.0 MIME-Version: 1.0 X-Originating-IP: [10.136.114.155] X-ClientProxiedBy: dggems702-chm.china.huawei.com (10.3.19.179) To dggpemm500021.china.huawei.com (7.185.36.109) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org From: Di Zhu When doing the test of restarting the network card, the system is broken because the port->slave is null pointer in agg_device_up(). After in-depth investigation, we found the real cause: in bond_3ad_unbind_slave() if there are no active ports in the aggregator to be deleted, the ad_clear_agg() will be called to set "aggregator->lag_ports = NULL", but the ports originally belonging to the aggregator are still linked together. Before bond_3ad_unbind_slave(): aggregator4->lag_ports = port1->port2->port3 After bond_3ad_unbind_slave(): aggregator4->lag_ports = NULL port1->port2->port3 After the port2 is deleted, the port is still remain in the linked list: because the port does not belong to any agg, so unbind do nothing for this port. After a while, bond_3ad_state_machine_handler() will run and traverse each existing port, trying to bind each port to the newly selected agg, such as: if (!found) { if (free_aggregator) { ... port->aggregator->lag_ports = port; ... } } After this operation, the link list looks like this: aggregator1->lag_ports = port1->port2(has been deleted)->port3 After that, just traverse the linked list of agg1 and access the port2->slave, the crash will happen. The easiest way to fix it is: if a port does not belong to any agg, delete it from the list and wait for the state machine to select the agg again. Fixes: 0622cab0341c ("bonding: fix 802.3ad aggregator reselection") Signed-off-by: Di Zhu --- /* v2 */ -David Miller -add Fixes: tag --- drivers/net/bonding/bond_3ad.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c index 6908822d9773..1d6ff4e1ed28 100644 --- a/drivers/net/bonding/bond_3ad.c +++ b/drivers/net/bonding/bond_3ad.c @@ -1793,6 +1793,8 @@ static void ad_agg_selection_logic(struct aggregator *agg, static void ad_clear_agg(struct aggregator *aggregator) { if (aggregator) { + struct port *port, *next; + aggregator->is_individual = false; aggregator->actor_admin_aggregator_key = 0; aggregator->actor_oper_aggregator_key = 0; @@ -1801,6 +1803,11 @@ static void ad_clear_agg(struct aggregator *aggregator) aggregator->partner_oper_aggregator_key = 0; aggregator->receive_state = 0; aggregator->transmit_state = 0; + for (port = aggregator->lag_ports; port; port = next) { + next = port->next_port_in_aggregator; + if (port->aggregator == aggregator) + port->next_port_in_aggregator = NULL; + } aggregator->lag_ports = NULL; aggregator->is_active = 0; aggregator->num_of_ports = 0;