evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'bond_neigh_parms'

Browse source 
Veaceslav Falico says:

====================
Recent patches revealed an old bug, which was there for quite awhile. It's
related to vlan on top of bonding and ndo_neigh_setup(). When vlan device
is initiated, it calls its real_dev->ndo_neigh_setup(), and in case of
bonding - it will modify neigh_parms->neigh_setup to point to
bond_neigh_init, while neigh_parms are of vlan's dev.

This way, when neigh_parms->neigh_setup() of vlan's dev is called, the
bonding function will be called, which expects the dev to be struct
bonding, but will receive a vlan dev.

It was hidden before because of bond->first_slave usage. Now, with
Nikolay's conversion to list/RCU, first_slave is gone and we hit a null
pointer dereference when working with lists/slave.

First patch moves ndo_neigh_setup() in neigh_parms_alloc() to the bottom,
so that the ->dev will be available to the caller. It doesn't really change
anything, however is needed for the second patch.

Second patch makes bond_neigh_setup() (bond->ndo_neigh_setup()) check if
the neigh_parms are really from a bonding dev, and only modify the
neigh_setup in this case.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2013-08-02 15:44:33 -07:00
commit 4b42df5da8
2 changed files with 15 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
drivers/net/bonding/bond_main.c
View file

@ -3630,11 +3630,17 @@ static int bond_neigh_init(struct neighbour *n)
* The bonding ndo_neigh_setup is called at init time beofre any * The bonding ndo_neigh_setup is called at init time beofre any
* slave exists. So we must declare proxy setup function which will * slave exists. So we must declare proxy setup function which will
* be used at run time to resolve the actual slave neigh param setup. * be used at run time to resolve the actual slave neigh param setup.
*
* It's also called by master devices (such as vlans) to setup their
* underlying devices. In that case - do nothing, we're already set up from
* our init.
*/ */
static int bond_neigh_setup(struct net_device *dev, static int bond_neigh_setup(struct net_device *dev,
struct neigh_parms *parms) struct neigh_parms *parms)
{ {
parms->neigh_setup = bond_neigh_init; /* modify only our neigh_parms */
if (parms->dev == dev)
parms->neigh_setup = bond_neigh_init;
return 0; return 0;
} }

14
net/core/neighbour.c
View file

@ -1441,16 +1441,18 @@ struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
atomic_set(&p->refcnt, 1); atomic_set(&p->refcnt, 1);
p->reachable_time = p->reachable_time =
neigh_rand_reach_time(p->base_reachable_time); neigh_rand_reach_time(p->base_reachable_time);
if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
kfree(p);
return NULL;
}
dev_hold(dev); dev_hold(dev);
p->dev = dev; p->dev = dev;
write_pnet(&p->net, hold_net(net)); write_pnet(&p->net, hold_net(net));
p->sysctl_table = NULL; p->sysctl_table = NULL;
if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
release_net(net);
dev_put(dev);
kfree(p);
return NULL;
}
write_lock_bh(&tbl->lock); write_lock_bh(&tbl->lock);
p->next = tbl->parms.next; p->next = tbl->parms.next;
tbl->parms.next = p; tbl->parms.next = p;