netdev - Re: [PATCH net] bonding: fix slave stuck in BOND_LINK

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAF2d9jj8UBuE=YTRT72z90OuLCy4+QsCThL9s3XxED8se=1ngA@mail.gmail.com>
Date:   Tue, 7 Nov 2017 18:05:47 -0800
From:   Mahesh Bandewar (महेश बंडेवार) 
        <maheshb@...gle.com>
To:     Jay Vosburgh <jay.vosburgh@...onical.com>
Cc:     linux-netdev <netdev@...r.kernel.org>,
        Alex Sidorenko <alexandre.sidorenko@....com>,
        Jarod Wilson <jarod@...hat.com>,
        Veaceslav Falico <vfalico@...il.com>,
        Andy Gospodarek <andy@...yhouse.net>,
        David Miller <davem@...emloft.net>
Subject: Re: [PATCH net] bonding: fix slave stuck in BOND_LINK_FAIL state

On Tue, Nov 7, 2017 at 2:50 AM, Jay Vosburgh <jay.vosburgh@...onical.com> wrote:
>         The bonding miimon logic has a flaw, in that a failure of the
> rtnl_trylock can cause a slave to become permanently stuck in
> BOND_LINK_FAIL state.
>
>         The sequence of events to cause this is as follows:
>
>         1) bond_miimon_inspect finds that a slave's link is down, and so
> calls bond_propose_link_state, setting slave->new_link_state to
> BOND_LINK_FAIL, then sets slave->new_link to BOND_LINK_DOWN and returns
> non-zero.
>
>         2) In bond_mii_monitor, the rtnl_trylock fails, and the timer is
> rescheduled.  No change is committed.
>
>         3) bond_miimon_inspect is called again, but this time the slave
> from step 1 has recovered.  slave->new_link is reset to NOCHANGE, and, as
> slave->link was never changed, the switch enters the BOND_LINK_UP case,
> and does nothing.  The pending BOND_LINK_FAIL state from step 1 remains
> pending, as new_link_state is not reset.
>
>         4) The state from step 3 persists until another slave changes link
> state and causes bond_miimon_inspect to return non-zero.  At this point,
> the BOND_LINK_FAIL state change on the slave from steps 1-3 is committed,
> and the slave will remain stuck in BOND_LINK_FAIL state even though it
> is actually link up.
>
>         The remedy for this is to initialize new_link_state on each entry
> to bond_miimon_inspect, as is already done with new_link.
>
> Reported-by: Alex Sidorenko <alexandre.sidorenko@....com>
> Reviewed-by: Jarod Wilson <jarod@...hat.com>
> Signed-off-by: Jay Vosburgh <jay.vosburgh@...onical.com>
> Fixes: fb9eb899a6dc ("bonding: handle link transition from FAIL to UP correctly")
Acked-by: Mahesh Bandewar <maheshb@...gle.com>
> ---
>  drivers/net/bonding/bond_main.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
> index c99dc59d729b..167434e952da 100644
> --- a/drivers/net/bonding/bond_main.c
> +++ b/drivers/net/bonding/bond_main.c
> @@ -2042,6 +2042,7 @@ static int bond_miimon_inspect(struct bonding *bond)
>
>         bond_for_each_slave_rcu(bond, slave, iter) {
>                 slave->new_link = BOND_LINK_NOCHANGE;
> +               slave->link_new_state = slave->link;
>
>                 link_state = bond_check_dev_link(bond, slave->dev, 0);
>
> --
> 2.14.1
>