linux-toradex.git/drivers/net/bonding/bond_main.c, branch v3.2.6

bonding: fix error handling if slave is busy (v2)

2012-01-12T19:29:45+00:00

commit f7d9821a6a9c83450ac35e76d3709e32fd38b76f upstream.

If slave device already has a receive handler registered, then the
error unwind of bonding device enslave function is broken.

The following will leave a pointer to freed memory in the slave
device list, causing a later kernel panic.
# modprobe dummy
# ip li add dummy0-1 link dummy0 type macvlan
# modprobe bonding
# echo +dummy0 >/sys/class/net/bond0/bonding/slaves

The fix is to detach the slave (which removes it from the list)
in the unwind path.

Signed-off-by: Stephen Hemminger 
Reviewed-by: Nicolas de Pesloüan 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

bonding: only use primary address for ARP

2011-12-01T03:59:11+00:00

Only use the primary address of the bond device
for master_ip. This will prevent changing the ARP source
address in Active-Backup mode whenever a secondry address
is added to the bond device.

Signed-off-by: Henrik Saavedra Persson 
Signed-off-by: Andy Gospodarek 
Signed-off-by: David S. Miller

bonding: comparing a u8 with -1 is always false

2011-11-04T22:37:23+00:00

slave->duplex is a u8 type so the in bond_info_show_slave() when we
check "if (slave->duplex == -1)", it's always false.

Signed-off-by: Dan Carpenter 
Signed-off-by: David S. Miller

bonding:update speed/duplex for NETDEV_CHANGE

2011-11-01T21:52:49+00:00

Zheng Liang(lzheng@redhat.com) found a bug that if we config bonding with
arp monitor, sometimes bonding driver cannot get the speed and duplex from
its slaves, it will assume them to be 100Mb/sec and Full, please see
/proc/net/bonding/bond0.
But there is no such problem when uses miimon.

(Take igb for example)
I find that the reason is that after dev_open() in bond_enslave(),
bond_update_speed_duplex() will call igb_get_settings()
, but in that function,
it runs ethtool_cmd_speed_set(ecmd, -1); ecmd->duplex = -1;
because igb get an error value of status.
So even dev_open() is called, but the device is not really ready to get its
settings.

Maybe it is safe for us to call igb_get_settings() only after
this message shows up, that is "igb: p4p1 NIC Link is Up 1000 Mbps Full Duplex,
Flow Control: RX".

So I prefer to update the speed and duplex for a slave when reseices
NETDEV_CHANGE/NETDEV_UP event.

Changelog
V2:
1 remove the "fake 100/Full" logic in bond_update_speed_duplex(),
  set speed and duplex to -1 when it gets error value of speed and duplex.
2 delete the warning in bond_enslave() if bond_update_speed_duplex() returns
  error.
3 make bond_info_show_slave() handle bad values of speed and duplex.

Signed-off-by: Weiping Pan 
Signed-off-by: David S. Miller

bonding: eliminate bond_close race conditions

2011-10-30T07:13:14+00:00

This patch resolves two sets of race conditions.

	Mitsuo Hayasaka  reported the
first, as follows:

The bond_close() calls cancel_delayed_work() to cancel delayed works.
It, however, cannot cancel works that were already queued in workqueue.
The bond_open() initializes work->data, and proccess_one_work() refers
get_work_cwq(work)->wq->flags. The get_work_cwq() returns NULL when
work->data has been initialized. Thus, a panic occurs.

	He included a patch that converted the cancel_delayed_work calls
in bond_close to flush_delayed_work_sync, which eliminated the above
problem.

	His patch is incorporated, at least in principle, into this
patch.  In this patch, we use cancel_delayed_work_sync in place of
flush_delayed_work_sync, and also convert bond_uninit in addition to
bond_close.

	This conversion to _sync, however, opens new races between
bond_close and three periodically executing workqueue functions:
bond_mii_monitor, bond_alb_monitor and bond_activebackup_arp_mon.

	The race occurs because bond_close and bond_uninit are always
called with RTNL held, and these workqueue functions may acquire RTNL to
perform failover-related activities.  If bond_close or bond_uninit is
waiting in cancel_delayed_work_sync, deadlock occurs.

	These deadlocks are resolved by having the workqueue functions
acquire RTNL conditionally.  If the rtnl_trylock() fails, the functions
reschedule and return immediately.  For the cases that are attempting to
perform link failover, a delay of 1 is used; for the other cases, the
normal interval is used (as those activities are not as time critical).

	Additionally, the bond_mii_monitor function now stores the delay
in a variable (mimicing the structure of activebackup_arp_mon).

	Lastly, all of the above renders the kill_timers sentinel moot,
and therefore it has been removed.

Tested-by: Mitsuo Hayasaka 
Signed-off-by: Jay Vosburgh 
Signed-off-by: David S. Miller

net: make bonding slaves honour master's skb->priority

2011-10-25T23:22:23+00:00

Signed-off-by: Maciej Żenczykowski 
Acked-by: Flavio Leitner 
Signed-off-by: Jay Vosburgh 
Signed-off-by: David S. Miller

Merge branch 'master' of ra.kernel.org:/pub/scm/linux/kernel/git/davem/net

2011-10-24T22:18:09+00:00

bonding: Use a per netns implementation of /sys/class/net/bonding_masters.

2011-10-19T23:24:15+00:00

This fixes a network namespace misfeature that bonding_masters looked at
current instead of the remembering the context where in which
/sys/class/net/bonding_masters was opened in to see which network
namespace to act upon.

This removes the need for sysfs to handle tagged directories with
untagged members allowing for a conceptually simpler sysfs
implementation.

Signed-off-by: Eric W. Biederman 
Acked-by: Greg Kroah-Hartman 
Signed-off-by: David S. Miller

bonding: use local function pointer of bond->recv_probe in bond_handle_frame

2011-10-19T04:14:22+00:00

The bond->recv_probe is called in bond_handle_frame() when
a packet is received, but bond_close() sets it to NULL. So,
a panic occurs when both functions work in parallel.

Why this happen:
After null pointer check of bond->recv_probe, an sk_buff is
duplicated and bond->recv_probe is called in bond_handle_frame.
So, a panic occurs when bond_close() is called between the
check and call of bond->recv_probe.

Patch:
This patch uses a local function pointer of bond->recv_probe
in bond_handle_frame(). So, it can avoid the null pointer
dereference.

Signed-off-by: Mitsuo Hayasaka 
Cc: Jay Vosburgh 
Cc: Andy Gospodarek 
Cc: Eric Dumazet 
Cc: WANG Cong 
Acked-by: Eric Dumazet 
Signed-off-by: David S. Miller

Merge branch 'master' of github.com:davem330/net

2011-10-07T17:38:43+00:00

Conflicts:
	net/batman-adv/soft-interface.c