netdev - Re: [PATCH net] bonding: stop the device in bond_setup_by

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 10 Nov 2023 11:19:22 +0200
From: Jay Vosburgh <jay.vosburgh@...onical.com>
To: Hangbin Liu <liuhangbin@...il.com>
cc: Eric Dumazet <edumazet@...gle.com>,
    "David S . Miller" <davem@...emloft.net>,
    Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
    Andy Gospodarek <andy@...yhouse.net>, netdev@...r.kernel.org,
    eric.dumazet@...il.com, syzbot <syzkaller@...glegroups.com>
Subject: Re: [PATCH net] bonding: stop the device in bond_setup_by_slave()

Hangbin Liu <liuhangbin@...il.com> wrote:

>On Thu, Nov 09, 2023 at 06:01:02PM +0000, Eric Dumazet wrote:
>> Commit 9eed321cde22 ("net: lapbether: only support ethernet devices")
>> has been able to keep syzbot away from net/lapb, until today.
>> 
>> In the following splat [1], the issue is that a lapbether device has
>> been created on a bonding device without members. Then adding a non
>> ARPHRD_ETHER member forced the bonding master to change its type.
>> 
>> The fix is to make sure we call dev_close() in bond_setup_by_slave()
>> so that the potential linked lapbether devices (or any other devices
>> having assumptions on the physical device) are removed.
>> 
>> A similar bug has been addressed in commit 40baec225765
>> ("bonding: fix panic on non-ARPHRD_ETHER enslave failure")
>> 
>
>Do we need also do this if the bond changed to ether device from other dev
>type? e.g.
>
>    if (slave_dev->type != ARPHRD_ETHER)
>            bond_setup_by_slave(bond_dev, slave_dev);
>    else
>            bond_ether_setup(bond_dev);

	I'm not sure I follow your comment; bond_enslave() already has
the above logic.  If the bond is not ARPHRD_ETHER and an ARPHRD_ETHER
device is added to the bond, the above will take the bond_ether_setup()
path, which will call ether_setup() which will set the device to
ARPHRD_ETHER.

	However, my recollection is that the bond device itself should
be unregistered if the last interface of a non-ARPHRD_ETHER bond is
removed.  This dates back to d90a162a4ee2 ("net/bonding: Destroy bonding
master when last slave is gone"), but I don't know if the logic still
works correctly (I've not heard much about IPoIB with bonding in a
while).  The bond cannot be initially created as non-ARPHRD_ETHER; the
type changes when the first such interface is added to the bond.

	-J

---
	-Jay Vosburgh, jay.vosburgh@...onical.com