[PATCH -net v2 0/2] bonding: fix arp_validate desync state & race

[PATCH -net v2 0/2] bonding: fix arp_validate desync state & race

[Nikolay Aleksandrov]

Hello all,
These two patches aim to fix the possible de-sync state which the bond
can enter if we have arp_validate without arp_interval or the other way
around. They also fix a race condition between arp_validate setting and
mode changing.

Patch 01 - fixes the race condition between store_arp_validate and bond
mode change by using rtnl for sync
Patch 02 - fixes the possible de-sync state by setting/unsetting recv_probe
if arp_interval is set/unset and also if arp_validate is set/unset

v2: Fix the mode check in store_arp_validate

Best regards,
 Nikolay Aleksandrov


Nikolay Aleksandrov (2):
  bonding: fix store_arp_validate race with mode change
  bonding: fix bond_arp_rcv setting and arp validate desync state

 drivers/net/bonding/bond_main.c  |  4 ++--
 drivers/net/bonding/bond_sysfs.c | 31 +++++++++++++++++++++++++------
 drivers/net/bonding/bonding.h    |  1 +
 3 files changed, 28 insertions(+), 8 deletions(-)

-- 
1.8.1.4

[PATCH -net v2 1/2] bonding: fix store_arp_validate race with mode change

[Nikolay Aleksandrov]

We need to protect store_arp_validate via rtnl because it can race with
mode changing and we can end up having arp_validate set in a mode
different from active-backup.

Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
---
v2: no change

 drivers/net/bonding/bond_sysfs.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index ce46776..4e38683 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -419,27 +419,33 @@ static ssize_t bonding_store_arp_validate(struct device *d,
 					  struct device_attribute *attr,
 					  const char *buf, size_t count)
 {
-	int new_value;
+	int new_value, ret = count;
 	struct bonding *bond = to_bond(d);
 
+	if (!rtnl_trylock())
+		return restart_syscall();
 	new_value = bond_parse_parm(buf, arp_validate_tbl);
 	if (new_value < 0) {
 		pr_err("%s: Ignoring invalid arp_validate value %s\n",
 		       bond->dev->name, buf);
-		return -EINVAL;
+		ret = -EINVAL;
+		goto out;
 	}
 	if (new_value && (bond->params.mode != BOND_MODE_ACTIVEBACKUP)) {
 		pr_err("%s: arp_validate only supported in active-backup mode.\n",
 		       bond->dev->name);
-		return -EINVAL;
+		ret = -EINVAL;
+		goto out;
 	}
 	pr_info("%s: setting arp_validate to %s (%d).\n",
 		bond->dev->name, arp_validate_tbl[new_value].modename,
 		new_value);
 
 	bond->params.arp_validate = new_value;
+out:
+	rtnl_unlock();
 
-	return count;
+	return ret;
 }
 
 static DEVICE_ATTR(arp_validate, S_IRUGO | S_IWUSR, bonding_show_arp_validate,
-- 
1.8.1.4

[PATCH -net v2 2/2] bonding: fix bond_arp_rcv setting and arp validate desync state

[Nikolay Aleksandrov]

We make bond_arp_rcv global so it can be used in bond_sysfs if the bond
interface is up and arp_interval is being changed to a positive value
and cleared otherwise as per Jay's suggestion.
This also fixes a problem where bond_arp_rcv was set even though
arp_validate was disabled while the bond was up by unsetting recv_probe
in bond_store_arp_validate and respectively setting it if enabled.

Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
---
v2: fix the mode check in store_arp_validate
I've intentionally left the prototype line >80 chars, let me know if I
should break it.

 drivers/net/bonding/bond_main.c  |  4 ++--
 drivers/net/bonding/bond_sysfs.c | 19 ++++++++++++++++---
 drivers/net/bonding/bonding.h    |  1 +
 3 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 39e5b1c..72df399 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2404,8 +2404,8 @@ static void bond_validate_arp(struct bonding *bond, struct slave *slave, __be32
 	slave->target_last_arp_rx[i] = jiffies;
 }
 
-static int bond_arp_rcv(const struct sk_buff *skb, struct bonding *bond,
-			struct slave *slave)
+int bond_arp_rcv(const struct sk_buff *skb, struct bonding *bond,
+		 struct slave *slave)
 {
 	struct arphdr *arp = (struct arphdr *)skb->data;
 	unsigned char *arp_ptr;
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 4e38683..eeab40b 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -349,6 +349,8 @@ static ssize_t bonding_store_mode(struct device *d,
 		goto out;
 	}
 
+	/* don't cache arp_validate between modes */
+	bond->params.arp_validate = BOND_ARP_VALIDATE_NONE;
 	bond->params.mode = new_value;
 	bond_set_mode_ops(bond, bond->params.mode);
 	pr_info("%s: setting mode to %s (%d).\n",
@@ -419,8 +421,8 @@ static ssize_t bonding_store_arp_validate(struct device *d,
 					  struct device_attribute *attr,
 					  const char *buf, size_t count)
 {
-	int new_value, ret = count;
 	struct bonding *bond = to_bond(d);
+	int new_value, ret = count;
 
 	if (!rtnl_trylock())
 		return restart_syscall();
@@ -431,7 +433,7 @@ static ssize_t bonding_store_arp_validate(struct device *d,
 		ret = -EINVAL;
 		goto out;
 	}
-	if (new_value && (bond->params.mode != BOND_MODE_ACTIVEBACKUP)) {
+	if (bond->params.mode != BOND_MODE_ACTIVEBACKUP) {
 		pr_err("%s: arp_validate only supported in active-backup mode.\n",
 		       bond->dev->name);
 		ret = -EINVAL;
@@ -441,6 +443,12 @@ static ssize_t bonding_store_arp_validate(struct device *d,
 		bond->dev->name, arp_validate_tbl[new_value].modename,
 		new_value);
 
+	if (bond->dev->flags & IFF_UP) {
+		if (!new_value)
+			bond->recv_probe = NULL;
+		else if (bond->params.arp_interval)
+			bond->recv_probe = bond_arp_rcv;
+	}
 	bond->params.arp_validate = new_value;
 out:
 	rtnl_unlock();
@@ -561,8 +569,8 @@ static ssize_t bonding_store_arp_interval(struct device *d,
 					  struct device_attribute *attr,
 					  const char *buf, size_t count)
 {
-	int new_value, ret = count;
 	struct bonding *bond = to_bond(d);
+	int new_value, ret = count;
 
 	if (!rtnl_trylock())
 		return restart_syscall();
@@ -605,8 +613,13 @@ static ssize_t bonding_store_arp_interval(struct device *d,
 		 * is called.
 		 */
 		if (!new_value) {
+			if (bond->params.arp_validate)
+				bond->recv_probe = NULL;
 			cancel_delayed_work_sync(&bond->arp_work);
 		} else {
+			/* arp_validate can be set only in active-backup mode */
+			if (bond->params.arp_validate)
+				bond->recv_probe = bond_arp_rcv;
 			cancel_delayed_work_sync(&bond->mii_work);
 			queue_delayed_work(bond->wq, &bond->arp_work, 0);
 		}
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index f7ab161..7ad8bd5 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -430,6 +430,7 @@ static inline bool slave_can_tx(struct slave *slave)
 
 struct bond_net;
 
+int bond_arp_rcv(const struct sk_buff *skb, struct bonding *bond, struct slave *slave);
 struct vlan_entry *bond_next_vlan(struct bonding *bond, struct vlan_entry *curr);
 int bond_dev_queue_xmit(struct bonding *bond, struct sk_buff *skb, struct net_device *slave_dev);
 void bond_xmit_slave_id(struct bonding *bond, struct sk_buff *skb, int slave_id);
-- 
1.8.1.4

Re: [PATCH -net v2 2/2] bonding: fix bond_arp_rcv setting and arp validate desync state

[Marcelo Ricardo Leitner]

Em 06-09-2013 19:00, Nikolay Aleksandrov escreveu:
> We make bond_arp_rcv global so it can be used in bond_sysfs if the bond
> interface is up and arp_interval is being changed to a positive value
> and cleared otherwise as per Jay's suggestion.
> This also fixes a problem where bond_arp_rcv was set even though
> arp_validate was disabled while the bond was up by unsetting recv_probe
> in bond_store_arp_validate and respectively setting it if enabled.
>
> Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>

Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com>

> ---
> v2: fix the mode check in store_arp_validate
> I've intentionally left the prototype line >80 chars, let me know if I
> should break it.
>
>   drivers/net/bonding/bond_main.c  |  4 ++--
>   drivers/net/bonding/bond_sysfs.c | 19 ++++++++++++++++---
>   drivers/net/bonding/bonding.h    |  1 +
>   3 files changed, 19 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
> index 39e5b1c..72df399 100644
> --- a/drivers/net/bonding/bond_main.c
> +++ b/drivers/net/bonding/bond_main.c
> @@ -2404,8 +2404,8 @@ static void bond_validate_arp(struct bonding *bond, struct slave *slave, __be32
>   	slave->target_last_arp_rx[i] = jiffies;
>   }
>
> -static int bond_arp_rcv(const struct sk_buff *skb, struct bonding *bond,
> -			struct slave *slave)
> +int bond_arp_rcv(const struct sk_buff *skb, struct bonding *bond,
> +		 struct slave *slave)
>   {
>   	struct arphdr *arp = (struct arphdr *)skb->data;
>   	unsigned char *arp_ptr;
> diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
> index 4e38683..eeab40b 100644
> --- a/drivers/net/bonding/bond_sysfs.c
> +++ b/drivers/net/bonding/bond_sysfs.c
> @@ -349,6 +349,8 @@ static ssize_t bonding_store_mode(struct device *d,
>   		goto out;
>   	}
>
> +	/* don't cache arp_validate between modes */
> +	bond->params.arp_validate = BOND_ARP_VALIDATE_NONE;
>   	bond->params.mode = new_value;
>   	bond_set_mode_ops(bond, bond->params.mode);
>   	pr_info("%s: setting mode to %s (%d).\n",
> @@ -419,8 +421,8 @@ static ssize_t bonding_store_arp_validate(struct device *d,
>   					  struct device_attribute *attr,
>   					  const char *buf, size_t count)
>   {
> -	int new_value, ret = count;
>   	struct bonding *bond = to_bond(d);
> +	int new_value, ret = count;
>
>   	if (!rtnl_trylock())
>   		return restart_syscall();
> @@ -431,7 +433,7 @@ static ssize_t bonding_store_arp_validate(struct device *d,
>   		ret = -EINVAL;
>   		goto out;
>   	}
> -	if (new_value && (bond->params.mode != BOND_MODE_ACTIVEBACKUP)) {
> +	if (bond->params.mode != BOND_MODE_ACTIVEBACKUP) {
>   		pr_err("%s: arp_validate only supported in active-backup mode.\n",
>   		       bond->dev->name);
>   		ret = -EINVAL;
> @@ -441,6 +443,12 @@ static ssize_t bonding_store_arp_validate(struct device *d,
>   		bond->dev->name, arp_validate_tbl[new_value].modename,
>   		new_value);
>
> +	if (bond->dev->flags & IFF_UP) {
> +		if (!new_value)
> +			bond->recv_probe = NULL;
> +		else if (bond->params.arp_interval)
> +			bond->recv_probe = bond_arp_rcv;
> +	}
>   	bond->params.arp_validate = new_value;
>   out:
>   	rtnl_unlock();
> @@ -561,8 +569,8 @@ static ssize_t bonding_store_arp_interval(struct device *d,
>   					  struct device_attribute *attr,
>   					  const char *buf, size_t count)
>   {
> -	int new_value, ret = count;
>   	struct bonding *bond = to_bond(d);
> +	int new_value, ret = count;
>
>   	if (!rtnl_trylock())
>   		return restart_syscall();
> @@ -605,8 +613,13 @@ static ssize_t bonding_store_arp_interval(struct device *d,
>   		 * is called.
>   		 */
>   		if (!new_value) {
> +			if (bond->params.arp_validate)
> +				bond->recv_probe = NULL;
>   			cancel_delayed_work_sync(&bond->arp_work);
>   		} else {
> +			/* arp_validate can be set only in active-backup mode */
> +			if (bond->params.arp_validate)
> +				bond->recv_probe = bond_arp_rcv;
>   			cancel_delayed_work_sync(&bond->mii_work);
>   			queue_delayed_work(bond->wq, &bond->arp_work, 0);
>   		}
> diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
> index f7ab161..7ad8bd5 100644
> --- a/drivers/net/bonding/bonding.h
> +++ b/drivers/net/bonding/bonding.h
> @@ -430,6 +430,7 @@ static inline bool slave_can_tx(struct slave *slave)
>
>   struct bond_net;
>
> +int bond_arp_rcv(const struct sk_buff *skb, struct bonding *bond, struct slave *slave);
>   struct vlan_entry *bond_next_vlan(struct bonding *bond, struct vlan_entry *curr);
>   int bond_dev_queue_xmit(struct bonding *bond, struct sk_buff *skb, struct net_device *slave_dev);
>   void bond_xmit_slave_id(struct bonding *bond, struct sk_buff *skb, int slave_id);
>

Re: [-net,v2,1/2] bonding: fix store_arp_validate race with mode change

[Veaceslav Falico]

On Sat, Sep 07, 2013 at 12:00:25AM +0200, nikolay@redhat.com wrote:
>We need to protect store_arp_validate via rtnl because it can race with
>mode changing and we can end up having arp_validate set in a mode
>different from active-backup.
>
>Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>

Acked-by: Veaceslav Falico <vfalico@redhat.com>

>
>---
>v2: no change
>
> drivers/net/bonding/bond_sysfs.c | 14 ++++++++++----
> 1 file changed, 10 insertions(+), 4 deletions(-)
>
>diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
>index ce46776..4e38683 100644
>--- a/drivers/net/bonding/bond_sysfs.c
>+++ b/drivers/net/bonding/bond_sysfs.c
>@@ -419,27 +419,33 @@ static ssize_t bonding_store_arp_validate(struct device *d,
> 					  struct device_attribute *attr,
> 					  const char *buf, size_t count)
> {
>-	int new_value;
>+	int new_value, ret = count;
> 	struct bonding *bond = to_bond(d);

p.s. If, by any chance, there'll be another v3 - move that struct before
ints :). But it's ok as is, anyway.

>
>+	if (!rtnl_trylock())
>+		return restart_syscall();
> 	new_value = bond_parse_parm(buf, arp_validate_tbl);
> 	if (new_value < 0) {
> 		pr_err("%s: Ignoring invalid arp_validate value %s\n",
> 		       bond->dev->name, buf);
>-		return -EINVAL;
>+		ret = -EINVAL;
>+		goto out;
> 	}
> 	if (new_value && (bond->params.mode != BOND_MODE_ACTIVEBACKUP)) {
> 		pr_err("%s: arp_validate only supported in active-backup mode.\n",
> 		       bond->dev->name);
>-		return -EINVAL;
>+		ret = -EINVAL;
>+		goto out;
> 	}
> 	pr_info("%s: setting arp_validate to %s (%d).\n",
> 		bond->dev->name, arp_validate_tbl[new_value].modename,
> 		new_value);
>
> 	bond->params.arp_validate = new_value;
>+out:
>+	rtnl_unlock();
>
>-	return count;
>+	return ret;
> }
>
> static DEVICE_ATTR(arp_validate, S_IRUGO | S_IWUSR, bonding_show_arp_validate,

Re: [-net, v2, 2/2] bonding: fix bond_arp_rcv setting and arp validate desync state

[Veaceslav Falico]

On Sat, Sep 07, 2013 at 12:00:26AM +0200, nikolay@redhat.com wrote:
>We make bond_arp_rcv global so it can be used in bond_sysfs if the bond
>interface is up and arp_interval is being changed to a positive value
>and cleared otherwise as per Jay's suggestion.
>This also fixes a problem where bond_arp_rcv was set even though
>arp_validate was disabled while the bond was up by unsetting recv_probe
>in bond_store_arp_validate and respectively setting it if enabled.
>
>Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
>Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com>
>
>---
>v2: fix the mode check in store_arp_validate
>I've intentionally left the prototype line >80 chars, let me know if I
>should break it.
>
> drivers/net/bonding/bond_main.c  |  4 ++--
> drivers/net/bonding/bond_sysfs.c | 19 ++++++++++++++++---
> drivers/net/bonding/bonding.h    |  1 +
> 3 files changed, 19 insertions(+), 5 deletions(-)
>
>diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
>index 39e5b1c..72df399 100644
>--- a/drivers/net/bonding/bond_main.c
>+++ b/drivers/net/bonding/bond_main.c
>@@ -2404,8 +2404,8 @@ static void bond_validate_arp(struct bonding *bond, struct slave *slave, __be32
> 	slave->target_last_arp_rx[i] = jiffies;
> }
>
>-static int bond_arp_rcv(const struct sk_buff *skb, struct bonding *bond,
>-			struct slave *slave)
>+int bond_arp_rcv(const struct sk_buff *skb, struct bonding *bond,
>+		 struct slave *slave)
> {
> 	struct arphdr *arp = (struct arphdr *)skb->data;
> 	unsigned char *arp_ptr;
>diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
>index 4e38683..eeab40b 100644
>--- a/drivers/net/bonding/bond_sysfs.c
>+++ b/drivers/net/bonding/bond_sysfs.c
>@@ -349,6 +349,8 @@ static ssize_t bonding_store_mode(struct device *d,
> 		goto out;
> 	}
>
>+	/* don't cache arp_validate between modes */
>+	bond->params.arp_validate = BOND_ARP_VALIDATE_NONE;
> 	bond->params.mode = new_value;
> 	bond_set_mode_ops(bond, bond->params.mode);
> 	pr_info("%s: setting mode to %s (%d).\n",
>@@ -419,8 +421,8 @@ static ssize_t bonding_store_arp_validate(struct device *d,
> 					  struct device_attribute *attr,
> 					  const char *buf, size_t count)
> {
>-	int new_value, ret = count;
> 	struct bonding *bond = to_bond(d);
>+	int new_value, ret = count;

Ah, so you've made it in the second patch, sorry, didn't notice.

>
> 	if (!rtnl_trylock())
> 		return restart_syscall();
>@@ -431,7 +433,7 @@ static ssize_t bonding_store_arp_validate(struct device *d,
> 		ret = -EINVAL;
> 		goto out;
> 	}
>-	if (new_value && (bond->params.mode != BOND_MODE_ACTIVEBACKUP)) {
>+	if (bond->params.mode != BOND_MODE_ACTIVEBACKUP) {
> 		pr_err("%s: arp_validate only supported in active-backup mode.\n",
> 		       bond->dev->name);
> 		ret = -EINVAL;
>@@ -441,6 +443,12 @@ static ssize_t bonding_store_arp_validate(struct device *d,
> 		bond->dev->name, arp_validate_tbl[new_value].modename,
> 		new_value);
>
>+	if (bond->dev->flags & IFF_UP) {
>+		if (!new_value)
>+			bond->recv_probe = NULL;
>+		else if (bond->params.arp_interval)
>+			bond->recv_probe = bond_arp_rcv;
>+	}
> 	bond->params.arp_validate = new_value;
> out:
> 	rtnl_unlock();
>@@ -561,8 +569,8 @@ static ssize_t bonding_store_arp_interval(struct device *d,
> 					  struct device_attribute *attr,
> 					  const char *buf, size_t count)
> {
>-	int new_value, ret = count;
> 	struct bonding *bond = to_bond(d);
>+	int new_value, ret = count;
>
> 	if (!rtnl_trylock())
> 		return restart_syscall();
>@@ -605,8 +613,13 @@ static ssize_t bonding_store_arp_interval(struct device *d,
> 		 * is called.
> 		 */
> 		if (!new_value) {
>+			if (bond->params.arp_validate)
>+				bond->recv_probe = NULL;
> 			cancel_delayed_work_sync(&bond->arp_work);
> 		} else {
>+			/* arp_validate can be set only in active-backup mode */
>+			if (bond->params.arp_validate)
>+				bond->recv_probe = bond_arp_rcv;

This whole juggling is really annoying, however it's indeed the best way we
can fix now.

Thanks Nik.

Acked-by: Veaceslav Falico <vfalico@redhat.com>

> 			cancel_delayed_work_sync(&bond->mii_work);
> 			queue_delayed_work(bond->wq, &bond->arp_work, 0);
> 		}
>diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
>index f7ab161..7ad8bd5 100644
>--- a/drivers/net/bonding/bonding.h
>+++ b/drivers/net/bonding/bonding.h
>@@ -430,6 +430,7 @@ static inline bool slave_can_tx(struct slave *slave)
>
> struct bond_net;
>
>+int bond_arp_rcv(const struct sk_buff *skb, struct bonding *bond, struct slave *slave);
> struct vlan_entry *bond_next_vlan(struct bonding *bond, struct vlan_entry *curr);
> int bond_dev_queue_xmit(struct bonding *bond, struct sk_buff *skb, struct net_device *slave_dev);
> void bond_xmit_slave_id(struct bonding *bond, struct sk_buff *skb, int slave_id);

Re: [PATCH -net v2 0/2] bonding: fix arp_validate desync state & race

[David Miller]

From: Nikolay Aleksandrov <nikolay@redhat.com>
Date: Sat,  7 Sep 2013 00:00:24 +0200

> Hello all,
> These two patches aim to fix the possible de-sync state which the bond
> can enter if we have arp_validate without arp_interval or the other way
> around. They also fix a race condition between arp_validate setting and
> mode changing.
> 
> Patch 01 - fixes the race condition between store_arp_validate and bond
> mode change by using rtnl for sync
> Patch 02 - fixes the possible de-sync state by setting/unsetting recv_probe
> if arp_interval is set/unset and also if arp_validate is set/unset
> 
> v2: Fix the mode check in store_arp_validate

Series applied, thank you.