Merge branch 'bond_neigh_parms' (4b42df5d) · Commits · 戴 / test

Veaceslav Falico says: ==================== Recent patches revealed an old bug, which was there for quite awhile. It's related to vlan on top of bonding and ndo_neigh_setup(). When vlan device is initiated, it calls its real_dev->ndo_neigh_setup(), and in case of bonding - it will modify neigh_parms->neigh_setup to point to bond_neigh_init, while neigh_parms are of vlan's dev. This way, when neigh_parms->neigh_setup() of vlan's dev is called, the bonding function will be called, which expects the dev to be struct bonding, but will receive a vlan dev. It was hidden before because of bond->first_slave usage. Now, with Nikolay's conversion to list/RCU, first_slave is gone and we hit a null pointer dereference when working with lists/slave. First patch moves ndo_neigh_setup() in neigh_parms_alloc() to the bottom, so that the ->dev will be available to the caller. It doesn't really change anything, however is needed for the second patch. Second patch makes bond_neigh_setup() (bond->ndo_neigh_setup()) check if the neigh_parms are really from a bonding dev, and only modify the neigh_setup in this case. ==================== Signed-off-by:

David S. Miller <davem@davemloft.net>

drivers/net/bonding/bond_main.c

+7 −1

Original line number	Diff line number	Diff line
		@@ -3630,10 +3630,16 @@ static int bond_neigh_init(struct neighbour *n)
		* The bonding ndo_neigh_setup is called at init time beofre any
		* slave exists. So we must declare proxy setup function which will
		* be used at run time to resolve the actual slave neigh param setup.
		*
		* It's also called by master devices (such as vlans) to setup their
		* underlying devices. In that case - do nothing, we're already set up from
		* our init.
		*/
		static int bond_neigh_setup(struct net_device *dev,
		struct neigh_parms *parms)
		{
		/* modify only our neigh_parms */
		if (parms->dev == dev)
		parms->neigh_setup = bond_neigh_init;

		return 0;

net/core/neighbour.c

+6 −4

Original line number	Diff line number	Diff line
		@@ -1441,16 +1441,18 @@ struct neigh_parms neigh_parms_alloc(struct net_device dev,
		atomic_set(&p->refcnt, 1);
		p->reachable_time =
		neigh_rand_reach_time(p->base_reachable_time);
		dev_hold(dev);
		p->dev = dev;
		write_pnet(&p->net, hold_net(net));
		p->sysctl_table = NULL;

		if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
		release_net(net);
		dev_put(dev);
		kfree(p);
		return NULL;
		}

		dev_hold(dev);
		p->dev = dev;
		write_pnet(&p->net, hold_net(net));
		p->sysctl_table = NULL;
		write_lock_bh(&tbl->lock);
		p->next = tbl->parms.next;
		tbl->parms.next = p;

Admin message