• Paolo Abeni's avatar
    bonding: avoid defaulting hard_header_len to ETH_HLEN on slave removal · 19cdead3
    Paolo Abeni authored
    On slave list updates, the bonding driver computes its hard_header_len
    as the maximum of all enslaved devices's hard_header_len.
    If the slave list is empty, e.g. on last enslaved device removal,
    ETH_HLEN is used.
    
    Since the bonding header_ops are set only when the first enslaved
    device is attached, the above can lead to header_ops->create()
    being called with the wrong skb headroom in place.
    
    If bond0 is configured on top of ipoib devices, with the
    following commands:
    
    ifup bond0
    for slave in $BOND_SLAVES_LIST; do
    	ip link set dev $slave nomaster
    done
    ping -c 1 <ip on bond0 subnet>
    
    we will obtain a skb_under_panic() with a similar call trace:
    	skb_push+0x3d/0x40
    	push_pseudo_header+0x17/0x30 [ib_ipoib]
    	ipoib_hard_header+0x4e/0x80 [ib_ipoib]
    	arp_create+0x12f/0x220
    	arp_send_dst.part.19+0x28/0x50
    	arp_solicit+0x115/0x290
    	neigh_probe+0x4d/0x70
    	__neigh_event_send+0xa7/0x230
    	neigh_resolve_output+0x12e/0x1c0
    	ip_finish_output2+0x14b/0x390
    	ip_finish_output+0x136/0x1e0
    	ip_output+0x76/0xe0
    	ip_local_out+0x35/0x40
    	ip_send_skb+0x19/0x40
    	ip_push_pending_frames+0x33/0x40
    	raw_sendmsg+0x7d3/0xb50
    	inet_sendmsg+0x31/0xb0
    	sock_sendmsg+0x38/0x50
    	SYSC_sendto+0x102/0x190
    	SyS_sendto+0xe/0x10
    	do_syscall_64+0x67/0x180
    	entry_SYSCALL64_slow_path+0x25/0x25
    
    This change addresses the issue avoiding updating the bonding device
    hard_header_len when the slaves list become empty, forbidding to
    shrink it below the value used by header_ops->create().
    
    The bug is there since commit 54ef3137 ("[PATCH] bonding: Handle large
    hard_header_len") but the panic can be triggered only since
    commit fc791b63
    
     ("IB/ipoib: move back IB LL address into the hard
    header").
    Reported-by: default avatarNorbert P <noe@physik.uzh.ch>
    Fixes: 54ef3137 ("[PATCH] bonding: Handle large hard_header_len")
    Fixes: fc791b63
    
     ("IB/ipoib: move back IB LL address into the hard header")
    Signed-off-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
    Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
    Signed-off-by: default avatarJay Vosburgh <jay.vosburgh@canonical.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    19cdead3
bond_main.c 132 KB