From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Eric Dumazet <eric.dumazet@gmail.com>,
Andy Gospodarek <andy@greyhouse.net>,
Jay Vosburgh <j.vosburgh@gmail.com>,
Veaceslav Falico <vfalico@gmail.com>,
Nikolay Aleksandrov <nikolay@redhat.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 3.16 21/55] bonding: fix div by zero while enslaving and transmitting
Date: Mon, 13 Oct 2014 04:24:35 +0200 [thread overview]
Message-ID: <20141013022444.631607043@linuxfoundation.org> (raw)
In-Reply-To: <20141013022443.729870634@linuxfoundation.org>
3.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <nikolay@redhat.com>
[ Upstream commit 9a72c2da690d78e93cff24b9f616412508678dd5 ]
The problem is that the slave is first linked and slave_cnt is
incremented afterwards leading to a div by zero in the modes that use it
as a modulus. What happens is that in bond_start_xmit()
bond_has_slaves() is used to evaluate further transmission and it becomes
true after the slave is linked in, but when slave_cnt is used in the xmit
path it is still 0, so fetch it once and transmit based on that. Since
it is used only in round-robin and XOR modes, the fix is only for them.
Thanks to Eric Dumazet for pointing out the fault in my first try to fix
this.
Call trace (took it out of net-next kernel, but it's the same with net):
[46934.330038] divide error: 0000 [#1] SMP
[46934.330041] Modules linked in: bonding(O) 9p fscache
snd_hda_codec_generic crct10dif_pclmul
[46934.330041] bond0: Enslaving eth1 as an active interface with an up
link
[46934.330051] ppdev joydev crc32_pclmul crc32c_intel 9pnet_virtio
ghash_clmulni_intel snd_hda_intel 9pnet snd_hda_controller parport_pc
serio_raw pcspkr snd_hda_codec parport virtio_balloon virtio_console
snd_hwdep snd_pcm pvpanic i2c_piix4 snd_timer i2ccore snd soundcore
virtio_blk virtio_net virtio_pci virtio_ring virtio ata_generic
pata_acpi floppy [last unloaded: bonding]
[46934.330053] CPU: 1 PID: 3382 Comm: ping Tainted: G O
3.17.0-rc4+ #27
[46934.330053] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[46934.330054] task: ffff88005aebf2c0 ti: ffff88005b728000 task.ti:
ffff88005b728000
[46934.330059] RIP: 0010:[<ffffffffa0198c33>] [<ffffffffa0198c33>]
bond_start_xmit+0x1c3/0x450 [bonding]
[46934.330060] RSP: 0018:ffff88005b72b7f8 EFLAGS: 00010246
[46934.330060] RAX: 0000000000000679 RBX: ffff88004b077000 RCX:
000000000000002a
[46934.330061] RDX: 0000000000000000 RSI: ffff88004b3f0500 RDI:
ffff88004b077940
[46934.330061] RBP: ffff88005b72b830 R08: 00000000000000c0 R09:
ffff88004a83e000
[46934.330062] R10: 000000000000ffff R11: ffff88004b1f12c0 R12:
ffff88004b3f0500
[46934.330062] R13: ffff88004b3f0500 R14: 000000000000002a R15:
ffff88004b077940
[46934.330063] FS: 00007fbd91a4c740(0000) GS:ffff88005f080000(0000)
knlGS:0000000000000000
[46934.330064] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[46934.330064] CR2: 00007f803a8bb000 CR3: 000000004b2c9000 CR4:
00000000000406e0
[46934.330069] Stack:
[46934.330071] ffffffff811e6169 00000000e772fa05 ffff88004b077000
ffff88004b3f0500
[46934.330072] ffffffff81d17d18 000000000000002a 0000000000000000
ffff88005b72b8a0
[46934.330073] ffffffff81620108 ffffffff8161fe0e ffff88005b72b8c4
ffff88005b302000
[46934.330073] Call Trace:
[46934.330077] [<ffffffff811e6169>] ?
__kmalloc_node_track_caller+0x119/0x300
[46934.330084] [<ffffffff81620108>] dev_hard_start_xmit+0x188/0x410
[46934.330086] [<ffffffff8161fe0e>] ? harmonize_features+0x2e/0x90
[46934.330088] [<ffffffff81620b06>] __dev_queue_xmit+0x456/0x590
[46934.330089] [<ffffffff81620c50>] dev_queue_xmit+0x10/0x20
[46934.330090] [<ffffffff8168f022>] arp_xmit+0x22/0x60
[46934.330091] [<ffffffff8168f090>] arp_send.part.16+0x30/0x40
[46934.330092] [<ffffffff8168f1e5>] arp_solicit+0x115/0x2b0
[46934.330094] [<ffffffff8160b5d7>] ? copy_skb_header+0x17/0xa0
[46934.330096] [<ffffffff8162875a>] neigh_probe+0x4a/0x70
[46934.330097] [<ffffffff8162979c>] __neigh_event_send+0xac/0x230
[46934.330098] [<ffffffff8162a00b>] neigh_resolve_output+0x13b/0x220
[46934.330100] [<ffffffff8165f120>] ? ip_forward_options+0x1c0/0x1c0
[46934.330101] [<ffffffff81660478>] ip_finish_output+0x1f8/0x860
[46934.330102] [<ffffffff81661f08>] ip_output+0x58/0x90
[46934.330103] [<ffffffff81661602>] ? __ip_local_out+0xa2/0xb0
[46934.330104] [<ffffffff81661640>] ip_local_out_sk+0x30/0x40
[46934.330105] [<ffffffff81662a66>] ip_send_skb+0x16/0x50
[46934.330106] [<ffffffff81662ad3>] ip_push_pending_frames+0x33/0x40
[46934.330107] [<ffffffff8168854c>] raw_sendmsg+0x88c/0xa30
[46934.330110] [<ffffffff81612b31>] ? skb_recv_datagram+0x41/0x60
[46934.330111] [<ffffffff816875a9>] ? raw_recvmsg+0xa9/0x1f0
[46934.330113] [<ffffffff816978d4>] inet_sendmsg+0x74/0xc0
[46934.330114] [<ffffffff81697a9b>] ? inet_recvmsg+0x8b/0xb0
[46934.330115] bond0: Adding slave eth2
[46934.330116] [<ffffffff8160357c>] sock_sendmsg+0x9c/0xe0
[46934.330118] [<ffffffff81603248>] ?
move_addr_to_kernel.part.20+0x28/0x80
[46934.330121] [<ffffffff811b4477>] ? might_fault+0x47/0x50
[46934.330122] [<ffffffff816039b9>] ___sys_sendmsg+0x3a9/0x3c0
[46934.330125] [<ffffffff8144a14a>] ? n_tty_write+0x3aa/0x530
[46934.330127] [<ffffffff810d1ae4>] ? __wake_up+0x44/0x50
[46934.330129] [<ffffffff81242b38>] ? fsnotify+0x238/0x310
[46934.330130] [<ffffffff816048a1>] __sys_sendmsg+0x51/0x90
[46934.330131] [<ffffffff816048f2>] SyS_sendmsg+0x12/0x20
[46934.330134] [<ffffffff81738b29>] system_call_fastpath+0x16/0x1b
[46934.330144] Code: 48 8b 10 4c 89 ee 4c 89 ff e8 aa bc ff ff 31 c0 e9
1a ff ff ff 0f 1f 00 4c 89 ee 4c 89 ff e8 65 fb ff ff 31 d2 4c 89 ee 4c
89 ff <f7> b3 64 09 00 00 e8 02 bd ff ff 31 c0 e9 f2 fe ff ff 0f 1f 00
[46934.330146] RIP [<ffffffffa0198c33>] bond_start_xmit+0x1c3/0x450
[bonding]
[46934.330146] RSP <ffff88005b72b7f8>
CC: Eric Dumazet <eric.dumazet@gmail.com>
CC: Andy Gospodarek <andy@greyhouse.net>
CC: Jay Vosburgh <j.vosburgh@gmail.com>
CC: Veaceslav Falico <vfalico@gmail.com>
Fixes: 278b208375 ("bonding: initial RCU conversion")
Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/bonding/bond_main.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3667,8 +3667,14 @@ static int bond_xmit_roundrobin(struct s
else
bond_xmit_slave_id(bond, skb, 0);
} else {
- slave_id = bond_rr_gen_slave_id(bond);
- bond_xmit_slave_id(bond, skb, slave_id % bond->slave_cnt);
+ int slave_cnt = ACCESS_ONCE(bond->slave_cnt);
+
+ if (likely(slave_cnt)) {
+ slave_id = bond_rr_gen_slave_id(bond);
+ bond_xmit_slave_id(bond, skb, slave_id % slave_cnt);
+ } else {
+ dev_kfree_skb_any(skb);
+ }
}
return NETDEV_TX_OK;
@@ -3699,8 +3705,13 @@ static int bond_xmit_activebackup(struct
static int bond_xmit_xor(struct sk_buff *skb, struct net_device *bond_dev)
{
struct bonding *bond = netdev_priv(bond_dev);
+ int slave_cnt = ACCESS_ONCE(bond->slave_cnt);
- bond_xmit_slave_id(bond, skb, bond_xmit_hash(bond, skb) % bond->slave_cnt);
+ if (likely(slave_cnt))
+ bond_xmit_slave_id(bond, skb,
+ bond_xmit_hash(bond, skb) % slave_cnt);
+ else
+ dev_kfree_skb_any(skb);
return NETDEV_TX_OK;
}
next prev parent reply other threads:[~2014-10-13 2:24 UTC|newest]
Thread overview: 58+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-10-13 2:24 [PATCH 3.16 00/55] 3.16.6-stable review Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 01/55] netlink: reset network header before passing to taps Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 02/55] rtnetlink: fix VF info size Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 03/55] net: Always untag vlan-tagged traffic on input Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 04/55] myri10ge: check for DMA mapping errors Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 05/55] Revert "macvlan: simplify the structure port" Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 06/55] tcp: dont use timestamp from repaired skb-s to calculate RTT (v2) Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 07/55] sit: Fix ipip6_tunnel_lookup device matching criteria Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 08/55] tcp: fix tcp_release_cb() to dispatch via address family for mtu_reduced() Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 09/55] tcp: fix ssthresh and undo for consecutive short FRTO episodes Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 10/55] net: phy: smsc: move smsc_phy_config_init reset part in a soft_reset function Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 11/55] tipc: fix message importance range check Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 12/55] packet: handle too big packets for PACKET_V3 Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 13/55] bnx2x: Revert UNDI flushing mechanism Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 14/55] net: ipv6: fib: dont sleep inside atomic lock Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 15/55] openvswitch: fix panic with multiple vlan headers Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 16/55] vxlan: fix incorrect initializer in union vxlan_addr Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 17/55] net: fix checksum features handling in netif_skb_features() Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 18/55] ipv6: fix rtnl locking in setsockopt for anycast and multicast Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 19/55] l2tp: fix race while getting PMTU on PPP pseudo-wire Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 20/55] ipv6: restore the behavior of ipv6_sock_ac_drop() Greg Kroah-Hartman
2014-10-13 2:24 ` Greg Kroah-Hartman [this message]
2014-10-13 2:24 ` [PATCH 3.16 22/55] net: filter: fix possible use after free Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 23/55] bridge: Check if vlan filtering is enabled only once Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 24/55] bridge: Fix br_should_learn to check vlan_enabled Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 25/55] net: allow macvlans to move to net namespace Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 26/55] macvlan: allow to enqueue broadcast pkt on virtual device Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 27/55] tg3: Work around HW/FW limitations with vlan encapsulated frames Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 28/55] tg3: Allow for recieve of full-size 8021AD frames Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 29/55] xfrm: Generate blackhole routes only from route lookup functions Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 30/55] xfrm: Generate queueing " Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 31/55] ip_tunnel: Dont allow to add the same tunnel multiple times Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 32/55] macvtap: Fix race between device delete and open Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 33/55] Revert "net/macb: add pinctrl consumer support" Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 34/55] net/mlx4_core: Allow not to specify probe_vf in SRIOV IB mode Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 35/55] net/mlx4: Correctly configure single ported VFs from the host Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 36/55] gro: fix aggregation for skb using frag_list Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 37/55] ipv6: remove rt6i_genid Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 38/55] hyperv: Fix a bug in netvsc_start_xmit() Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 39/55] ip6_gre: fix flowi6_proto value in xmit path Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 40/55] net: systemport: fix bcm_sysport_insert_tsb() Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 41/55] team: avoid race condition in scheduling delayed work Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 42/55] hyperv: Fix a bug in netvsc_send() Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 43/55] sctp: handle association restarts when the socket is closed Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 44/55] net_sched: copy exts->type in tcf_exts_change() Greg Kroah-Hartman
2014-10-13 2:24 ` [PATCH 3.16 45/55] uas: Add a quirk for rejecting ATA_12 and ATA_16 commands Greg Kroah-Hartman
2014-10-13 2:25 ` [PATCH 3.16 46/55] uas: Add no-report-opcodes quirk Greg Kroah-Hartman
2014-10-13 2:25 ` [PATCH 3.16 47/55] uas: Add US_FL_NO_ATA_1X quirk for Seagate (0bc2:ab20) drives Greg Kroah-Hartman
2014-10-13 2:25 ` [PATCH 3.16 48/55] uas: Add another ASM1051 usb-id to the uas blacklist Greg Kroah-Hartman
2014-10-13 2:25 ` [PATCH 3.16 49/55] USB: Add device quirk for ASUS T100 Base Station keyboard Greg Kroah-Hartman
2014-10-13 2:25 ` [PATCH 3.16 50/55] USB: serial: cp210x: added Ketra N1 wireless interface support Greg Kroah-Hartman
2014-10-13 2:25 ` [PATCH 3.16 51/55] USB: cp210x: add support for Seluxit USB dongle Greg Kroah-Hartman
2014-10-13 2:25 ` [PATCH 3.16 52/55] usb: musb: dsps: kill OTG timer on suspend Greg Kroah-Hartman
2014-10-13 2:25 ` [PATCH 3.16 53/55] crypto: caam - fix addressing of struct member Greg Kroah-Hartman
2014-10-13 2:25 ` [PATCH 3.16 54/55] driver/base/node: remove unnecessary kfree of node struct from unregister_one_node Greg Kroah-Hartman
2014-10-13 2:25 ` [PATCH 3.16 55/55] serial: 8250: Add Quark X1000 to 8250_pci.c Greg Kroah-Hartman
2014-10-13 15:19 ` [PATCH 3.16 00/55] 3.16.6-stable review Guenter Roeck
2014-10-13 20:32 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20141013022444.631607043@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=andy@greyhouse.net \
--cc=davem@davemloft.net \
--cc=eric.dumazet@gmail.com \
--cc=j.vosburgh@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=nikolay@redhat.com \
--cc=stable@vger.kernel.org \
--cc=vfalico@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).