netdev - Re: [PATCH v2 net] bonding: fix state transition issue in link monitoring

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20191105.174051.2132646390435868066.davem@davemloft.net>
Date:   Tue, 05 Nov 2019 17:40:51 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     jay.vosburgh@...onical.com
Cc:     netdev@...r.kernel.org, zakharov.a.g@...dex.ru,
        zhangsha.zhang@...wei.com, maheshb@...gle.com, vfalico@...il.com,
        andy@...yhouse.net
Subject: Re: [PATCH v2 net] bonding: fix state transition issue in link
 monitoring

From: Jay Vosburgh <jay.vosburgh@...onical.com>
Date: Fri, 01 Nov 2019 21:56:42 -0700

> 	 Since de77ecd4ef02 ("bonding: improve link-status update in
> mii-monitoring"), the bonding driver has utilized two separate variables
> to indicate the next link state a particular slave should transition to.
> Each is used to communicate to a different portion of the link state
> change commit logic; one to the bond_miimon_commit function itself, and
> another to the state transition logic.
> 
> 	Unfortunately, the two variables can become unsynchronized,
> resulting in incorrect link state transitions within bonding.  This can
> cause slaves to become stuck in an incorrect link state until a
> subsequent carrier state transition.
> 
> 	The issue occurs when a special case in bond_slave_netdev_event
> sets slave->link directly to BOND_LINK_FAIL.  On the next pass through
> bond_miimon_inspect after the slave goes carrier up, the BOND_LINK_FAIL
> case will set the proposed next state (link_new_state) to BOND_LINK_UP,
> but the new_link to BOND_LINK_DOWN.  The setting of the final link state
> from new_link comes after that from link_new_state, and so the slave
> will end up incorrectly in _DOWN state.
> 
> 	Resolve this by combining the two variables into one.
> 
> Reported-by: Aleksei Zakharov <zakharov.a.g@...dex.ru>
> Reported-by: Sha Zhang <zhangsha.zhang@...wei.com>
> Cc: Mahesh Bandewar <maheshb@...gle.com>
> Fixes: de77ecd4ef02 ("bonding: improve link-status update in mii-monitoring")
> Signed-off-by: Jay Vosburgh <jay.vosburgh@...onical.com>

Applied and queued up for -stable, thanks.