netdev - Re: [PATCH net-next] bonding: fix system hang due to fast igmp timer rescheduling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7289.1375209640@death.nxdomain>
Date:	Tue, 30 Jul 2013 11:40:40 -0700
From:	Jay Vosburgh <fubar@...ibm.com>
To:	Nikolay Aleksandrov <nikolay@...hat.com>
cc:	netdev@...r.kernel.org, andy@...yhouse.net
Subject: Re: [PATCH net-next] bonding: fix system hang due to fast igmp timer rescheduling

Nikolay Aleksandrov <nikolay@...hat.com> wrote:

>From: Nikolay Aleksandrov <Nikolay Aleksandrov nikolay@...hat.com>
>
>After commit 4aa5dee4d9 ("net: convert resend IGMP to notifier event")
>we try to acquire rtnl in bond_resend_igmp_join_requests but it can be
>scheduled with rtnl already held (e.g. when bond_change_active_slave is
>called with rtnl) causing a loop of immediate reschedules + calls because
>rtnl_trylock fails each time since it's being already held.
>For me this issue leads to system hangs very easy:
>modprobe bonding; ifconfig bond0 up; ifenslave bond0 eth0; rmmod
>bonding;

	I believe that bond_change_active_slave is always called with
rtnl held, and it is the only caller of bond_resend_igmp_join_requests
(well, "caller" in the sense that it queues the delayed work for
mcast_work that runs the function, currently with delay of 0).

>The fix is to introduce a small (1 jiffy) delay which is enough for the
>sections holding rtnl to finish without putting any strain on the system.

	Should the delay also be in the bond_change_active_slave queue
work call as well, to eliminate one loop of the "rtnl_trylock failing ->
queue_delayed_work" sequence in bond_resend_igmp_join_requests?

	-J

>Signed-off-by: Nikolay Aleksandrov <nikolay@...hat.com>
>---
> drivers/net/bonding/bond_main.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
>index da3af63..9d94313 100644
>--- a/drivers/net/bonding/bond_main.c
>+++ b/drivers/net/bonding/bond_main.c
>@@ -723,7 +723,7 @@ static int bond_set_allmulti(struct bonding *bond, int inc)
> static void bond_resend_igmp_join_requests(struct bonding *bond)
> {
> 	if (!rtnl_trylock()) {
>-		queue_delayed_work(bond->wq, &bond->mcast_work, 0);
>+		queue_delayed_work(bond->wq, &bond->mcast_work, 1);
> 		return;
> 	}
> 	call_netdevice_notifiers(NETDEV_RESEND_IGMP, bond->dev);
>-- 
>1.8.1.4

---
	-Jay Vosburgh, IBM Linux Technology Center, fubar@...ibm.com

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html