netdev - Re: [PATCH net-next v4 5/6] bonding: restructure and add rcu for bond_for_each_slave

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <5229C397.3080703@redhat.com>
Date:	Fri, 06 Sep 2013 13:59:19 +0200
From:	Nikolay Aleksandrov <nikolay@...hat.com>
To:	Ding Tianhong <dingtianhong@...wei.com>
CC:	Jay Vosburgh <fubar@...ibm.com>,
	Andy Gospodarek <andy@...yhouse.net>,
	"David S. Miller" <davem@...emloft.net>,
	Veaceslav Falico <vfalico@...hat.com>,
	Netdev <netdev@...r.kernel.org>
Subject: Re: [PATCH net-next v4 5/6] bonding: restructure and add rcu for
 bond_for_each_slave_next()

On 09/06/2013 09:28 AM, Ding Tianhong wrote:
> Restructure the bond_for_each_slave(), remove the checking for bond->slave_cnt,
> make the new loop be more simple and racy.
> 
> Add bond_for_each_slave_next_rcu() for next patch use.
> 
> Suggested-by: Nikolay Aleksandrov <nikolay@...hat.com>
> Suggested-by: Veaceslav Falico <vfalico@...hat.com>
> Signed-off-by: Ding Tianhong <dingtianhong@...wei.com>
> Cc: Nikolay Aleksandrov <nikolay@...hat.com>
> Cc: Veaceslav Falico <vfalico@...hat.com>
> ---
>  drivers/net/bonding/bond_alb.c  |  3 +--
>  drivers/net/bonding/bond_main.c |  6 ++----
>  drivers/net/bonding/bonding.h   | 21 +++++++++++++++++----
>  3 files changed, 20 insertions(+), 10 deletions(-)
> 
> diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
> index 91f179d..c75d383 100644
> --- a/drivers/net/bonding/bond_alb.c
> +++ b/drivers/net/bonding/bond_alb.c
> @@ -383,7 +383,6 @@ static struct slave *rlb_next_rx_slave(struct bonding *bond)
>  {
>  	struct alb_bond_info *bond_info = &(BOND_ALB_INFO(bond));
>  	struct slave *rx_slave, *slave, *start_at;
> -	int i = 0;
>  
>  	if (bond_info->next_rx_slave)
>  		start_at = bond_info->next_rx_slave;
> @@ -392,7 +391,7 @@ static struct slave *rlb_next_rx_slave(struct bonding *bond)
>  
>  	rx_slave = NULL;
>  
> -	bond_for_each_slave_from(bond, slave, i, start_at) {
> +	bond_for_each_slave_from(bond, slave, start_at) {
>  		if (SLAVE_IS_OK(slave)) {
>  			if (!rx_slave) {
>  				rx_slave = slave;
> diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
> index 39e5b1c..4190389 100644
> --- a/drivers/net/bonding/bond_main.c
> +++ b/drivers/net/bonding/bond_main.c
> @@ -782,7 +782,6 @@ static struct slave *bond_find_best_slave(struct bonding *bond)
>  	struct slave *new_active, *old_active;
>  	struct slave *bestslave = NULL;
>  	int mintime = bond->params.updelay;
> -	int i;
>  
>  	new_active = bond->curr_active_slave;
>  
> @@ -801,7 +800,7 @@ static struct slave *bond_find_best_slave(struct bonding *bond)
>  	/* remember where to stop iterating over the slaves */
>  	old_active = new_active;
>  
> -	bond_for_each_slave_from(bond, new_active, i, old_active) {
> +	bond_for_each_slave_from(bond, new_active, old_active) {
>  		if (new_active->link == BOND_LINK_UP) {
>  			return new_active;
>  		} else if (new_active->link == BOND_LINK_BACK &&
> @@ -2756,7 +2755,6 @@ do_failover:
>  static void bond_ab_arp_probe(struct bonding *bond)
>  {
>  	struct slave *slave, *next_slave;
> -	int i;
>  
>  	read_lock(&bond->curr_slave_lock);
>  
> @@ -2788,7 +2786,7 @@ static void bond_ab_arp_probe(struct bonding *bond)
>  
>  	/* search for next candidate */
>  	next_slave = bond_next_slave(bond, bond->current_arp_slave);
> -	bond_for_each_slave_from(bond, slave, i, next_slave) {
> +	bond_for_each_slave_from(bond, slave, next_slave) {
>  		if (IS_UP(slave->dev)) {
>  			slave->link = BOND_LINK_BACK;
>  			bond_set_slave_active_flags(slave);
> diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
> index 419161d..d80e146 100644
> --- a/drivers/net/bonding/bonding.h
> +++ b/drivers/net/bonding/bonding.h
> @@ -124,18 +124,31 @@
>  	(bond_is_first_slave(bond, pos) ? bond_last_slave_rcu(bond) : \
>  					  bond_to_slave_rcu((pos)->list.prev))
>  
> +/* Check whether the slave is the only one in bond */
> +
>  /**
>   * bond_for_each_slave_from - iterate the slaves list from a starting point
>   * @bond:	the bond holding this list.
>   * @pos:	current slave.
> - * @cnt:	counter for max number of moves
>   * @start:	starting point.
>   *
>   * Caller must hold bond->lock
>   */
> -#define bond_for_each_slave_from(bond, pos, cnt, start) \
> -	for (cnt = 0, pos = start; pos && cnt < (bond)->slave_cnt; \
> -	     cnt++, pos = bond_next_slave(bond, pos))
> +#define bond_for_each_slave_from(bond, pos, start) \
> +	for (pos = start; pos; (pos = bond_next_slave(bond, pos)) != start ? \
> +		(pos) : (pos = NULL))
> +
> +/**
> + * bond_for_each_slave_from_rcu - iterate the slaves list from a starting point
> + * @bond:	the bond holding this list.
> + * @pos:	current slave.
> + * @start:	starting point.
> + *
> + * Caller must hold rcu_read_lock
> + */
> +#define bond_for_each_slave_from_rcu(bond, pos, start) \
> +	for (pos = start; pos; (pos = bond_next_slave_rcu(bond, pos)) != start ? \
> +		(pos) : (pos = NULL))
>  
The same bug here as before... What happens if start disappears ? - Infinite
loop, pos will never be equal to start again.

>  /**
>   * bond_for_each_slave - iterate over all slaves
> 

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html