Commit f7d9821a authored by stephen hemminger's avatar stephen hemminger Committed by David S. Miller
Browse files

bonding: fix error handling if slave is busy (v2) 



If slave device already has a receive handler registered, then the
error unwind of bonding device enslave function is broken.

The following will leave a pointer to freed memory in the slave
device list, causing a later kernel panic.
# modprobe dummy
# ip li add dummy0-1 link dummy0 type macvlan
# modprobe bonding
# echo +dummy0 >/sys/class/net/bond0/bonding/slaves

The fix is to detach the slave (which removes it from the list)
in the unwind path.

Signed-off-by: default avatarStephen Hemminger <shemminger@vyatta.com>
Reviewed-by: default avatarNicolas de Pesloüan <nicolas.2p.debian@free.fr>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f872b237

drivers/net/bonding/bond_main.c

+7 −2
Original line number Diff line number Diff line
@@ -1822,7 +1822,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) 
				 "but new slave device does not support netpoll.\n",

				 bond_dev->name);

			res = -EBUSY;

			goto err_close;

			goto err_detach;

		}

	}

#endif
@@ -1831,7 +1831,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) 


	res = bond_create_slave_symlinks(bond_dev, slave_dev);

	if (res)

		goto err_close;

		goto err_detach;



	res = netdev_rx_handler_register(slave_dev, bond_handle_frame,

					 new_slave);
@@ -1852,6 +1852,11 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) 
err_dest_symlinks:

	bond_destroy_slave_symlinks(bond_dev, slave_dev);



err_detach:

	write_lock_bh(&bond->lock);

	bond_detach_slave(bond, new_slave);

	write_unlock_bh(&bond->lock);



err_close:

	dev_close(slave_dev);

CRA Git | Maintained and supported by SUSTech CRA and CCSE