[PATCH net-next 0/2] bonding: fix enslaving a dev without mtu setting support

[PATCH net-next 0/2] bonding: fix enslaving a dev without mtu setting support

[Veaceslav Falico]

Hi,

With the introduction of bond_free_slave() we need to have slave->bond
populated before calling it, however if the dev_mtu_set(slave, mtu) fails,
we call bond_free_slave() before actually setting slave->bond, and thus
we'll panic.

Fix this by populating slave->bond (and ->dev, it seems appropriate) as
early as possible.

Also, remove a harmful check for NULL in bond_get_bond_by_slave(), as it's
only hiding the real problem and making it harder to debug.

CC: Jay Vosburgh <j.vosburgh@gmail.com>
CC: Andy Gospodarek <andy@greyhouse.net>
CC: netdev@vger.kernel.org
Signed-off-by: Veaceslav Falico <vfalico@gmail.com>

---
 drivers/net/bonding/bond_main.c | 4 ++--
 drivers/net/bonding/bonding.h   | 2 --
 2 files changed, 2 insertions(+), 4 deletions(-)

[PATCH net-next 1/2] bonding: populate essential new_slave->bond/dev early

[Veaceslav Falico]

The new bond_free_slave() needs new_slave->bond to verify if additional
structures were allocated, so populate it early so that, in case of failure
in bond_enslave(), we would be able to get it.

Also populate the new_slave->dev field, as it's too one of the most needed
things to assign early.

CC: Jay Vosburgh <j.vosburgh@gmail.com>
CC: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: Veaceslav Falico <vfalico@gmail.com>
---
 drivers/net/bonding/bond_main.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 7123205..923cdd5a 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1325,6 +1325,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 		goto err_undo_flags;
 	}
 
+	new_slave->bond = bond;
+	new_slave->dev = slave_dev;
 	/*
 	 * Set the new_slave's queue_id to be zero.  Queue ID mapping
 	 * is set via sysfs or module option if desired.
@@ -1368,8 +1370,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 		goto err_restore_mac;
 	}
 
-	new_slave->bond = bond;
-	new_slave->dev = slave_dev;
 	slave_dev->priv_flags |= IFF_BONDING;
 
 	if (bond_is_lb(bond)) {
-- 
1.8.4

Re: [PATCH net-next 1/2] bonding: populate essential new_slave->bond/dev early

[Ding Tianhong]

On 2014/5/21 23:42, Veaceslav Falico wrote:
> The new bond_free_slave() needs new_slave->bond to verify if additional
> structures were allocated, so populate it early so that, in case of failure
> in bond_enslave(), we would be able to get it.
> 
> Also populate the new_slave->dev field, as it's too one of the most needed
> things to assign early.
> 
> CC: Jay Vosburgh <j.vosburgh@gmail.com>
> CC: Andy Gospodarek <andy@greyhouse.net>
> Signed-off-by: Veaceslav Falico <vfalico@gmail.com>
> ---
>  drivers/net/bonding/bond_main.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
> index 7123205..923cdd5a 100644
> --- a/drivers/net/bonding/bond_main.c
> +++ b/drivers/net/bonding/bond_main.c
> @@ -1325,6 +1325,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
>  		goto err_undo_flags;
>  	}
>  
> +	new_slave->bond = bond;
> +	new_slave->dev = slave_dev;
>  	/*
>  	 * Set the new_slave's queue_id to be zero.  Queue ID mapping
>  	 * is set via sysfs or module option if desired.
> @@ -1368,8 +1370,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
>  		goto err_restore_mac;
>  	}
>  
> -	new_slave->bond = bond;
> -	new_slave->dev = slave_dev;
>  	slave_dev->priv_flags |= IFF_BONDING;
>  
>  	if (bond_is_lb(bond)) {
> 

Good catch.

Acked-by: Ding Tianhong <dingtianhong@huawei.com>

[PATCH net-next 2/2] bonding: remove NULL verification from bond_get_bond_by_slave()

[Veaceslav Falico]

Every caller relies on the result being the actual bond, so this
verification just masks the real problem.

CC: Jay Vosburgh <j.vosburgh@gmail.com>
CC: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: Veaceslav Falico <vfalico@gmail.com>
---
 drivers/net/bonding/bonding.h | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index 44334b3d..dfc3779 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -249,8 +249,6 @@ static inline struct slave *bond_get_slave_by_dev(struct bonding *bond,
 
 static inline struct bonding *bond_get_bond_by_slave(struct slave *slave)
 {
-	if (!slave || !slave->bond)
-		return NULL;
 	return slave->bond;
 }
 
-- 
1.8.4

Re: [PATCH net-next 0/2] bonding: fix enslaving a dev without mtu setting support

[David Miller]

From: Veaceslav Falico <vfalico@gmail.com>
Date: Wed, 21 May 2014 17:41:59 +0200

> With the introduction of bond_free_slave() we need to have slave->bond
> populated before calling it, however if the dev_mtu_set(slave, mtu) fails,
> we call bond_free_slave() before actually setting slave->bond, and thus
> we'll panic.
> 
> Fix this by populating slave->bond (and ->dev, it seems appropriate) as
> early as possible.
> 
> Also, remove a harmful check for NULL in bond_get_bond_by_slave(), as it's
> only hiding the real problem and making it harder to debug.
> 
> CC: Jay Vosburgh <j.vosburgh@gmail.com>
> CC: Andy Gospodarek <andy@greyhouse.net>
> CC: netdev@vger.kernel.org
> Signed-off-by: Veaceslav Falico <vfalico@gmail.com>

Series applied to net-next, thanks.