linux-toradex.git/drivers/net/bonding/bond_alb.c, branch v3.0-rc4

bonding: prevent deadlock on slave store with alb mode (v3)

2011-05-25T21:55:33+00:00

This soft lockup was recently reported:

[root@dell-per715-01 ~]# echo +bond5 > /sys/class/net/bonding_masters
[root@dell-per715-01 ~]# echo +eth1 > /sys/class/net/bond5/bonding/slaves
bonding: bond5: doing slave updates when interface is down.
bonding bond5: master_dev is not up in bond_enslave
[root@dell-per715-01 ~]# echo -eth1 > /sys/class/net/bond5/bonding/slaves
bonding: bond5: doing slave updates when interface is down.

BUG: soft lockup - CPU#12 stuck for 60s! [bash:6444]
CPU 12:
Modules linked in: bonding autofs4 hidp rfcomm l2cap bluetooth lockd sunrpc
be2d
Pid: 6444, comm: bash Not tainted 2.6.18-262.el5 #1
RIP: 0010:[]  []
.text.lock.spinlock+0x26/00
RSP: 0018:ffff810113167da8  EFLAGS: 00000286
RAX: ffff810113167fd8 RBX: ffff810123a47800 RCX: 0000000000ff1025
RDX: 0000000000000000 RSI: ffff810123a47800 RDI: ffff81021b57f6f8
RBP: ffff81021b57f500 R08: 0000000000000000 R09: 000000000000000c
R10: 00000000ffffffff R11: ffff81011d41c000 R12: ffff81021b57f000
R13: 0000000000000000 R14: 0000000000000282 R15: 0000000000000282
FS:  00002b3b41ef3f50(0000) GS:ffff810123b27940(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00002b3b456dd000 CR3: 000000031fc60000 CR4: 00000000000006e0

Call Trace:
 [] _spin_lock_bh+0x9/0x14
 [] :bonding:tlb_clear_slave+0x22/0xa1
 [] :bonding:bond_alb_deinit_slave+0xba/0xf0
 [] :bonding:bond_release+0x1b4/0x450
 [] __down_write_nested+0x12/0x92
 [] :bonding:bonding_store_slaves+0x25c/0x2f7
 [] sysfs_write_file+0xb9/0xe8
 [] vfs_write+0xce/0x174
 [] sys_write+0x45/0x6e
 [] tracesys+0xd5/0xe0

It occurs because we are able to change the slave configuarion of a bond while
the bond interface is down.  The bonding driver initializes some data structures
only after its ndo_open routine is called.  Among them is the initalization of
the alb tx and rx hash locks.  So if we add or remove a slave without first
opening the bond master device, we run the risk of trying to lock/unlock a
spinlock that has garbage for data in it, which results in our above softlock.

Note that sometimes this works, because in many cases an unlocked spinlock has
the raw_lock parameter initialized to zero (meaning that the kzalloc of the
net_device private data is equivalent to calling spin_lock_init), but thats not
true in all cases, and we aren't guaranteed that condition, so we need to pass
the relevant spinlocks through the spin_lock_init function.

Fix it by moving the spin_lock_init calls for the tx and rx hashtable locks to
the ndo_init path, so they are ready for use by the bond_store_slaves path.

Change notes:
v2) Based on conversation with Jay and Nicolas it seems that the ability to
enslave devices while the bond master is down should be safe to do.  As such
this is an outlier bug, and so instead we'll just initalize the errant spinlocks
in the init path rather than the open path, solving the problem.  We'll also
remove the warnings about the bond being down during enslave operations, since
it should be safe

v3) Fix spelling error

Signed-off-by: Neil Horman 
Reported-by: jtluka@redhat.com
CC: Jay Vosburgh 
CC: Andy Gospodarek 
CC: nicolas.2p.debian@gmail.com
CC: "David S. Miller" 
Signed-off-by: Jay Vosburgh 
Signed-off-by: David S. Miller

net: bonding: factor out rlock(bond->lock) in xmit path

2011-05-09T19:05:59+00:00

Pull read_lock(&bond->lock) and BOND_IS_OK() to bond_start_xmit() from
mode-dependent xmit functions.

netif_running() is always true in hard_start_xmit.

Signed-off-by: Michał Mirosław 
Signed-off-by: David S. Miller

bonding: move processing of recv handlers into handle_frame()

2011-04-25T19:00:30+00:00

Since now when bonding uses rx_handler, all traffic going into bond
device goes thru bond_handle_frame. So there's no need to go back into
bonding code later via ptype handlers. This patch converts
original ptype handlers into "bonding receive probes". These functions
are called from bond_handle_frame and they are registered per-mode.

Note that vlan packets are also handled because they are always untagged
thanks to vlan_untag()

Note that this also allows arpmon for eth-bond-bridge-vlan topology.

Signed-off-by: Jiri Pirko 
Signed-off-by: David S. Miller

bonding:fix two typos

2011-04-11T20:15:56+00:00

replace relpy with reply.
replace premanent with permanent.

Signed-off-by: Weiping Pan(潘卫平) 
Signed-off-by: David S. Miller

bonding:set save_load to 0 when initializing

2011-04-11T20:15:54+00:00

It is unnecessary to set save_load to 1 here,
as the tx_hashtbl is just kzalloced.

Signed-off-by: Weiping Pan(潘卫平) 
Signed-off-by: Jay Vosburgh 
Signed-off-by: David S. Miller

bonding: use the correct size for _simple_hash()

2011-02-28T21:21:28+00:00

Clearly it should be the size of ->ip_dst here.
Although this is harmless, but it still reads odd.

Signed-off-by: WANG Cong 
Signed-off-by: David S. Miller

bonding: Ensure that we unshare skbs prior to calling pskb_may_pull

2011-01-21T00:45:56+00:00

Recently reported oops:

kernel BUG at net/core/skbuff.c:813!
invalid opcode: 0000 [#1] SMP
last sysfs file: /sys/devices/virtual/net/bond0/broadcast
CPU 8
Modules linked in: sit tunnel4 cpufreq_ondemand acpi_cpufreq freq_table bonding
ipv6 dm_mirror dm_region_hash dm_log cdc_ether usbnet mii serio_raw i2c_i801
i2c_core iTCO_wdt iTCO_vendor_support shpchp ioatdma i7core_edac edac_core bnx2
ixgbe dca mdio sg ext4 mbcache jbd2 sd_mod crc_t10dif mptsas mptscsih mptbase
scsi_transport_sas dm_mod [last unloaded: microcode]

Modules linked in: sit tunnel4 cpufreq_ondemand acpi_cpufreq freq_table bonding
ipv6 dm_mirror dm_region_hash dm_log cdc_ether usbnet mii serio_raw i2c_i801
i2c_core iTCO_wdt iTCO_vendor_support shpchp ioatdma i7core_edac edac_core bnx2
ixgbe dca mdio sg ext4 mbcache jbd2 sd_mod crc_t10dif mptsas mptscsih mptbase
scsi_transport_sas dm_mod [last unloaded: microcode]
Pid: 0, comm: swapper Not tainted 2.6.32-71.el6.x86_64 #1 BladeCenter HS22
-[7870AC1]-
RIP: 0010:[]  []
pskb_expand_head+0x36/0x1e0
RSP: 0018:ffff880028303b70  EFLAGS: 00010202
RAX: 0000000000000002 RBX: ffff880c6458ec80 RCX: 0000000000000020
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff880c6458ec80
RBP: ffff880028303bc0 R08: ffffffff818a6180 R09: ffff880c6458ed64
R10: ffff880c622b36c0 R11: 0000000000000400 R12: 0000000000000000
R13: 0000000000000180 R14: ffff880c622b3000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff880028300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 00000038653452a4 CR3: 0000000001001000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process swapper (pid: 0, threadinfo ffff8806649c2000, task ffff880c64f16ab0)
Stack:
 ffff880028303bc0 ffffffff8104fff9 000000000000001c 0000000100000000
<0> ffff880000047d80 ffff880c6458ec80 000000000000001c ffff880c6223da00
<0> ffff880c622b3000 0000000000000000 ffff880028303c10 ffffffff81407f7a
Call Trace:

 [] ? __wake_up_common+0x59/0x90
 [] __pskb_pull_tail+0x2aa/0x360
 [] bond_arp_rcv+0x2c0/0x2e0 [bonding]
 [] ? packet_rcv+0x377/0x440
 [] netif_receive_skb+0x2db/0x670
 [] napi_skb_finish+0x58/0x70
 [] napi_gro_receive+0x39/0x50
 [] ixgbe_clean_rx_irq+0x35b/0x900 [ixgbe]
 [] ixgbe_clean_rxtx_many+0x136/0x240 [ixgbe]
 [] net_rx_action+0x103/0x210
 [] __do_softirq+0xb7/0x1e0
 [] ? handle_IRQ_event+0x60/0x170
 [] call_softirq+0x1c/0x30
 [] do_softirq+0x65/0xa0
 [] irq_exit+0x85/0x90
 [] do_IRQ+0x75/0xf0
 [] ret_from_intr+0x0/0x11
 
 [] ? mwait_idle+0x71/0xd0
 [] ? atomic_notifier_call_chain+0x1a/0x20
 [] cpu_idle+0xb6/0x110
 [] start_secondary+0x1fc/0x23f

Resulted from bonding driver registering packet handlers via dev_add_pack and
then trying to call pskb_may_pull. If another packet handler (like for AF_PACKET
sockets) gets called first, the delivered skb will have a user count > 1, which
causes pskb_may_pull to BUG halt when it does its skb_shared check.  Fix this by
calling skb_share_check prior to the may_pull call sites in the bonding driver
to clone the skb when needed.  Tested by myself and the reported successfully.

Signed-off-by: Neil Horman
CC: Andy Gospodarek 
CC: Jay Vosburgh 
CC: "David S. Miller" 
Signed-off-by: Jay Vosburgh 
Signed-off-by: Andy Gospodarek 
Signed-off-by: David S. Miller

bonding: migrate some macros from bond_alb.c to bond_alb.h

2010-12-16T21:16:05+00:00

This patch simply migrates some macros from bond_alb.c to bond_alb.h.

Signed-off-by: Taku Izumi 
Signed-off-by: Jay Vosburgh 
Signed-off-by: David S. Miller

bonding: correctly process non-linear skbs

2010-09-14T21:25:32+00:00

It was recently brought to my attention that 802.3ad mode bonds would no
longer form when using some network hardware after a driver update.
After snooping around I realized that the particular hardware was using
page-based skbs and found that skb->data did not contain a valid LACPDU
as it was not stored there.  That explained the inability to form an
802.3ad-based bond.  For balance-alb mode bonds this was also an issue
as ARPs would not be properly processed.

This patch fixes the issue in my tests and should be applied to 2.6.36
and as far back as anyone cares to add it to stable.

Thanks to Alexander Duyck  and Jesse
Brandeburg  for the suggestions on this one.

Signed-off-by: Andy Gospodarek 
CC: Alexander Duyck 
CC: Jesse Brandeburg 
CC: stable@kerne.org
Signed-off-by: Jay Vosburgh 
Signed-off-by: David S. Miller

Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

2010-07-28T04:01:35+00:00

Conflicts:
	drivers/net/bnx2x_main.c

Merge bnx2x bug fixes in by hand... :-/

Signed-off-by: David S. Miller