* [PATCH net-next] bonding/main: fix NULL dereference in bond_select_active_slave()
@ 2019-07-01 17:48 Eric Dumazet
2019-07-01 19:15 ` Jay Vosburgh
2019-07-02 22:15 ` David Miller
0 siblings, 2 replies; 4+ messages in thread
From: Eric Dumazet @ 2019-07-01 17:48 UTC (permalink / raw)
To: David S . Miller
Cc: netdev, Eric Dumazet, Eric Dumazet, John Sperbeck, Jarod Wilson,
Jay Vosburgh, Veaceslav Falico, Andy Gospodarek
A bonding master can be up while best_slave is NULL.
[12105.636318] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
[12105.638204] mlx4_en: eth1: Linkstate event 1 -> 1
[12105.648984] IP: bond_select_active_slave+0x125/0x250
[12105.653977] PGD 0 P4D 0
[12105.656572] Oops: 0000 [#1] SMP PTI
[12105.660487] gsmi: Log Shutdown Reason 0x03
[12105.664620] Modules linked in: kvm_intel loop act_mirred uhaul vfat fat stg_standard_ftl stg_megablocks stg_idt stg_hdi stg elephant_dev_num stg_idt_eeprom w1_therm wire i2c_mux_pca954x i2c_mux mlx4_i2c i2c_usb cdc_acm ehci_pci ehci_hcd i2c_iimc mlx4_en mlx4_ib ib_uverbs ib_core mlx4_core [last unloaded: kvm_intel]
[12105.685686] mlx4_core 0000:03:00.0: dispatching link up event for port 2
[12105.685700] mlx4_en: eth2: Linkstate event 2 -> 1
[12105.685700] mlx4_en: eth2: Link Up (linkstate)
[12105.724452] Workqueue: bond0 bond_mii_monitor
[12105.728854] RIP: 0010:bond_select_active_slave+0x125/0x250
[12105.734355] RSP: 0018:ffffaf146a81fd88 EFLAGS: 00010246
[12105.739637] RAX: 0000000000000003 RBX: ffff8c62b03c6900 RCX: 0000000000000000
[12105.746838] RDX: 0000000000000000 RSI: ffffaf146a81fd08 RDI: ffff8c62b03c6000
[12105.754054] RBP: ffffaf146a81fdb8 R08: 0000000000000001 R09: ffff8c517d387600
[12105.761299] R10: 00000000001075d9 R11: ffffffffaceba92f R12: 0000000000000000
[12105.768553] R13: ffff8c8240ae4800 R14: 0000000000000000 R15: 0000000000000000
[12105.775748] FS: 0000000000000000(0000) GS:ffff8c62bfa40000(0000) knlGS:0000000000000000
[12105.783892] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[12105.789716] CR2: 0000000000000000 CR3: 0000000d0520e001 CR4: 00000000001626f0
[12105.796976] Call Trace:
[12105.799446] [<ffffffffac31d387>] bond_mii_monitor+0x497/0x6f0
[12105.805317] [<ffffffffabd42643>] process_one_work+0x143/0x370
[12105.811225] [<ffffffffabd42c7a>] worker_thread+0x4a/0x360
[12105.816761] [<ffffffffabd48bc5>] kthread+0x105/0x140
[12105.821865] [<ffffffffabd42c30>] ? rescuer_thread+0x380/0x380
[12105.827757] [<ffffffffabd48ac0>] ? kthread_associate_blkcg+0xc0/0xc0
[12105.834266] [<ffffffffac600241>] ret_from_fork+0x51/0x60
Fixes: e2a7420df2e0 ("bonding/main: convert to using slave printk macros")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: John Sperbeck <jsperbeck@google.com>
Cc: Jarod Wilson <jarod@redhat.com>
CC: Jay Vosburgh <j.vosburgh@gmail.com>
CC: Veaceslav Falico <vfalico@gmail.com>
CC: Andy Gospodarek <andy@greyhouse.net>
---
drivers/net/bonding/bond_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index a30595955a37a485b9e045a31969313f8336b668..84168455aded96dfd85b310841dee2a0d917b580 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -937,7 +937,7 @@ void bond_select_active_slave(struct bonding *bond)
return;
if (netif_carrier_ok(bond->dev))
- slave_info(bond->dev, best_slave->dev, "active interface up!\n");
+ netdev_info(bond->dev, "active interface up!\n");
else
netdev_info(bond->dev, "now running without any active interface!\n");
}
--
2.22.0.410.gd8fdbe21b5-goog
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net-next] bonding/main: fix NULL dereference in bond_select_active_slave()
2019-07-01 17:48 [PATCH net-next] bonding/main: fix NULL dereference in bond_select_active_slave() Eric Dumazet
@ 2019-07-01 19:15 ` Jay Vosburgh
2019-07-01 19:31 ` Eric Dumazet
2019-07-02 22:15 ` David Miller
1 sibling, 1 reply; 4+ messages in thread
From: Jay Vosburgh @ 2019-07-01 19:15 UTC (permalink / raw)
To: Eric Dumazet
Cc: David S . Miller, netdev, Eric Dumazet, John Sperbeck,
Jarod Wilson, Veaceslav Falico, Andy Gospodarek
Eric Dumazet <edumazet@google.com> wrote:
>A bonding master can be up while best_slave is NULL.
>
>[12105.636318] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
>[12105.638204] mlx4_en: eth1: Linkstate event 1 -> 1
>[12105.648984] IP: bond_select_active_slave+0x125/0x250
>[12105.653977] PGD 0 P4D 0
>[12105.656572] Oops: 0000 [#1] SMP PTI
>[12105.660487] gsmi: Log Shutdown Reason 0x03
>[12105.664620] Modules linked in: kvm_intel loop act_mirred uhaul vfat fat stg_standard_ftl stg_megablocks stg_idt stg_hdi stg elephant_dev_num stg_idt_eeprom w1_therm wire i2c_mux_pca954x i2c_mux mlx4_i2c i2c_usb cdc_acm ehci_pci ehci_hcd i2c_iimc mlx4_en mlx4_ib ib_uverbs ib_core mlx4_core [last unloaded: kvm_intel]
>[12105.685686] mlx4_core 0000:03:00.0: dispatching link up event for port 2
>[12105.685700] mlx4_en: eth2: Linkstate event 2 -> 1
>[12105.685700] mlx4_en: eth2: Link Up (linkstate)
>[12105.724452] Workqueue: bond0 bond_mii_monitor
>[12105.728854] RIP: 0010:bond_select_active_slave+0x125/0x250
>[12105.734355] RSP: 0018:ffffaf146a81fd88 EFLAGS: 00010246
>[12105.739637] RAX: 0000000000000003 RBX: ffff8c62b03c6900 RCX: 0000000000000000
>[12105.746838] RDX: 0000000000000000 RSI: ffffaf146a81fd08 RDI: ffff8c62b03c6000
>[12105.754054] RBP: ffffaf146a81fdb8 R08: 0000000000000001 R09: ffff8c517d387600
>[12105.761299] R10: 00000000001075d9 R11: ffffffffaceba92f R12: 0000000000000000
>[12105.768553] R13: ffff8c8240ae4800 R14: 0000000000000000 R15: 0000000000000000
>[12105.775748] FS: 0000000000000000(0000) GS:ffff8c62bfa40000(0000) knlGS:0000000000000000
>[12105.783892] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>[12105.789716] CR2: 0000000000000000 CR3: 0000000d0520e001 CR4: 00000000001626f0
>[12105.796976] Call Trace:
>[12105.799446] [<ffffffffac31d387>] bond_mii_monitor+0x497/0x6f0
>[12105.805317] [<ffffffffabd42643>] process_one_work+0x143/0x370
>[12105.811225] [<ffffffffabd42c7a>] worker_thread+0x4a/0x360
>[12105.816761] [<ffffffffabd48bc5>] kthread+0x105/0x140
>[12105.821865] [<ffffffffabd42c30>] ? rescuer_thread+0x380/0x380
>[12105.827757] [<ffffffffabd48ac0>] ? kthread_associate_blkcg+0xc0/0xc0
>[12105.834266] [<ffffffffac600241>] ret_from_fork+0x51/0x60
>
>Fixes: e2a7420df2e0 ("bonding/main: convert to using slave printk macros")
>Signed-off-by: Eric Dumazet <edumazet@google.com>
>Reported-by: John Sperbeck <jsperbeck@google.com>
>Cc: Jarod Wilson <jarod@redhat.com>
>CC: Jay Vosburgh <j.vosburgh@gmail.com>
>CC: Veaceslav Falico <vfalico@gmail.com>
>CC: Andy Gospodarek <andy@greyhouse.net>
>---
> drivers/net/bonding/bond_main.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
>index a30595955a37a485b9e045a31969313f8336b668..84168455aded96dfd85b310841dee2a0d917b580 100644
>--- a/drivers/net/bonding/bond_main.c
>+++ b/drivers/net/bonding/bond_main.c
>@@ -937,7 +937,7 @@ void bond_select_active_slave(struct bonding *bond)
> return;
>
> if (netif_carrier_ok(bond->dev))
>- slave_info(bond->dev, best_slave->dev, "active interface up!\n");
>+ netdev_info(bond->dev, "active interface up!\n");
> else
> netdev_info(bond->dev, "now running without any active interface!\n");
> }
What is the bonding mode and options in the failure case?
I see that the fix is fine in the sense that it returns to the
original status quo for the message.
However, the code path seems odd; if best_slave is NULL, that
means that bond_find_best_slave() saw all slaves as down, but if
netif_carrier_ok is true, then bond_set_carrier() did not.
-J
---
-Jay Vosburgh, jay.vosburgh@canonical.com
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net-next] bonding/main: fix NULL dereference in bond_select_active_slave()
2019-07-01 19:15 ` Jay Vosburgh
@ 2019-07-01 19:31 ` Eric Dumazet
0 siblings, 0 replies; 4+ messages in thread
From: Eric Dumazet @ 2019-07-01 19:31 UTC (permalink / raw)
To: Jay Vosburgh
Cc: David S . Miller, netdev, Eric Dumazet, John Sperbeck,
Jarod Wilson, Veaceslav Falico, Andy Gospodarek
On Mon, Jul 1, 2019 at 9:15 PM Jay Vosburgh <jay.vosburgh@canonical.com> wrote:
>
> Eric Dumazet <edumazet@google.com> wrote:
>
> >A bonding master can be up while best_slave is NULL.
> >
> >[12105.636318] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
> >[12105.638204] mlx4_en: eth1: Linkstate event 1 -> 1
> >[12105.648984] IP: bond_select_active_slave+0x125/0x250
> >[12105.653977] PGD 0 P4D 0
> >[12105.656572] Oops: 0000 [#1] SMP PTI
> >[12105.660487] gsmi: Log Shutdown Reason 0x03
> >[12105.664620] Modules linked in: kvm_intel loop act_mirred uhaul vfat fat stg_standard_ftl stg_megablocks stg_idt stg_hdi stg elephant_dev_num stg_idt_eeprom w1_therm wire i2c_mux_pca954x i2c_mux mlx4_i2c i2c_usb cdc_acm ehci_pci ehci_hcd i2c_iimc mlx4_en mlx4_ib ib_uverbs ib_core mlx4_core [last unloaded: kvm_intel]
> >[12105.685686] mlx4_core 0000:03:00.0: dispatching link up event for port 2
> >[12105.685700] mlx4_en: eth2: Linkstate event 2 -> 1
> >[12105.685700] mlx4_en: eth2: Link Up (linkstate)
> >[12105.724452] Workqueue: bond0 bond_mii_monitor
> >[12105.728854] RIP: 0010:bond_select_active_slave+0x125/0x250
> >[12105.734355] RSP: 0018:ffffaf146a81fd88 EFLAGS: 00010246
> >[12105.739637] RAX: 0000000000000003 RBX: ffff8c62b03c6900 RCX: 0000000000000000
> >[12105.746838] RDX: 0000000000000000 RSI: ffffaf146a81fd08 RDI: ffff8c62b03c6000
> >[12105.754054] RBP: ffffaf146a81fdb8 R08: 0000000000000001 R09: ffff8c517d387600
> >[12105.761299] R10: 00000000001075d9 R11: ffffffffaceba92f R12: 0000000000000000
> >[12105.768553] R13: ffff8c8240ae4800 R14: 0000000000000000 R15: 0000000000000000
> >[12105.775748] FS: 0000000000000000(0000) GS:ffff8c62bfa40000(0000) knlGS:0000000000000000
> >[12105.783892] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >[12105.789716] CR2: 0000000000000000 CR3: 0000000d0520e001 CR4: 00000000001626f0
> >[12105.796976] Call Trace:
> >[12105.799446] [<ffffffffac31d387>] bond_mii_monitor+0x497/0x6f0
> >[12105.805317] [<ffffffffabd42643>] process_one_work+0x143/0x370
> >[12105.811225] [<ffffffffabd42c7a>] worker_thread+0x4a/0x360
> >[12105.816761] [<ffffffffabd48bc5>] kthread+0x105/0x140
> >[12105.821865] [<ffffffffabd42c30>] ? rescuer_thread+0x380/0x380
> >[12105.827757] [<ffffffffabd48ac0>] ? kthread_associate_blkcg+0xc0/0xc0
> >[12105.834266] [<ffffffffac600241>] ret_from_fork+0x51/0x60
> >
> >Fixes: e2a7420df2e0 ("bonding/main: convert to using slave printk macros")
> >Signed-off-by: Eric Dumazet <edumazet@google.com>
> >Reported-by: John Sperbeck <jsperbeck@google.com>
> >Cc: Jarod Wilson <jarod@redhat.com>
> >CC: Jay Vosburgh <j.vosburgh@gmail.com>
> >CC: Veaceslav Falico <vfalico@gmail.com>
> >CC: Andy Gospodarek <andy@greyhouse.net>
> >---
> > drivers/net/bonding/bond_main.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> >diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
> >index a30595955a37a485b9e045a31969313f8336b668..84168455aded96dfd85b310841dee2a0d917b580 100644
> >--- a/drivers/net/bonding/bond_main.c
> >+++ b/drivers/net/bonding/bond_main.c
> >@@ -937,7 +937,7 @@ void bond_select_active_slave(struct bonding *bond)
> > return;
> >
> > if (netif_carrier_ok(bond->dev))
> >- slave_info(bond->dev, best_slave->dev, "active interface up!\n");
> >+ netdev_info(bond->dev, "active interface up!\n");
> > else
> > netdev_info(bond->dev, "now running without any active interface!\n");
> > }
>
> What is the bonding mode and options in the failure case?
I am not sure.
Basically I only have crash dumps at this point (no idea how to repro the bug)
I guess that is :
Bonding Mode: IEEE 802.3ad Dynamic link aggregation
Transmit Hash Policy: encap3+4 (4)
Use Carrier: 1
MII Status: up
MII Polling Interval (ms): 100
Up Delay (ms): 0
Down Delay (ms): 0
MAC address: 00:1a:11:c0:65:40
Active Members: eth1 eth2
>
> I see that the fix is fine in the sense that it returns to the
> original status quo for the message.
>
> However, the code path seems odd; if best_slave is NULL, that
> means that bond_find_best_slave() saw all slaves as down, but if
> netif_carrier_ok is true, then bond_set_carrier() did not.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net-next] bonding/main: fix NULL dereference in bond_select_active_slave()
2019-07-01 17:48 [PATCH net-next] bonding/main: fix NULL dereference in bond_select_active_slave() Eric Dumazet
2019-07-01 19:15 ` Jay Vosburgh
@ 2019-07-02 22:15 ` David Miller
1 sibling, 0 replies; 4+ messages in thread
From: David Miller @ 2019-07-02 22:15 UTC (permalink / raw)
To: edumazet
Cc: netdev, eric.dumazet, jsperbeck, jarod, j.vosburgh, vfalico, andy
From: Eric Dumazet <edumazet@google.com>
Date: Mon, 1 Jul 2019 10:48:51 -0700
> A bonding master can be up while best_slave is NULL.
...
> Fixes: e2a7420df2e0 ("bonding/main: convert to using slave printk macros")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reported-by: John Sperbeck <jsperbeck@google.com>
Applied, thanks.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-07-03 0:45 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-07-01 17:48 [PATCH net-next] bonding/main: fix NULL dereference in bond_select_active_slave() Eric Dumazet
2019-07-01 19:15 ` Jay Vosburgh
2019-07-01 19:31 ` Eric Dumazet
2019-07-02 22:15 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).