From: Jay Vosburgh <jay.vosburgh@canonical.com>
To: jinyiting <jinyiting@huawei.com>
Cc: vfalico@gmail.com, andy@greyhouse.net, davem@davemloft.net,
kuba@kernel.org, netdev@vger.kernel.org, security@kernel.org,
linux-kernel@vger.kernel.org, xuhanbing@huawei.com,
wangxiaogang3@huawei.com
Subject: Re: [PATCH] bonding: 3ad: update slave arr after initialize
Date: Thu, 15 Apr 2021 21:28:27 -0700 [thread overview]
Message-ID: <17733.1618547307@famine> (raw)
In-Reply-To: <1618537982-454-1-git-send-email-jinyiting@huawei.com>
jinyiting <jinyiting@huawei.com> wrote:
>From: jin yiting <jinyiting@huawei.com>
>
>The bond works in mode 4, and performs down/up operations on the bond
>that is normally negotiated. The probability of bond-> slave_arr is NULL
>
>Test commands:
> ifconfig bond1 down
> ifconfig bond1 up
>
>The conflict occurs in the following process:
>
>__dev_open (CPU A)
> --bond_open
> --queue_delayed_work(bond->wq,&bond->ad_work,0);
> --bond_update_slave_arr
> --bond_3ad_get_active_agg_info
>
>ad_work(CPU B)
> --bond_3ad_state_machine_handler
> --ad_agg_selection_logic
>
>ad_work runs on cpu B. In the function ad_agg_selection_logic, all
>agg->is_active will be cleared. Before the new active aggregator is
>selected on CPU B, bond_3ad_get_active_agg_info failed on CPU A,
>bond->slave_arr will be set to NULL. The best aggregator in
>ad_agg_selection_logic has not changed, no need to update slave arr.
>
>Signed-off-by: jin yiting <jinyiting@huawei.com>
>---
> drivers/net/bonding/bond_3ad.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
>diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
>index 6908822..d100079 100644
>--- a/drivers/net/bonding/bond_3ad.c
>+++ b/drivers/net/bonding/bond_3ad.c
>@@ -2327,6 +2327,12 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
>
> aggregator = __get_first_agg(port);
> ad_agg_selection_logic(aggregator, &update_slave_arr);
>+ if (!update_slave_arr) {
>+ struct aggregator *active = __get_active_agg(aggregator);
>+
>+ if (active && active->is_active)
>+ update_slave_arr = true;
>+ }
> }
> bond_3ad_set_carrier(bond);
> }
The described issue is a race condition (in that
ad_agg_selection_logic clears agg->is_active under mode_lock, but
bond_open -> bond_update_slave_arr is inspecting agg->is_active outside
the lock). I don't see how the above change will reliably manage this;
the real issue looks to be that bond_update_slave_arr is committing
changes to the array (via bond_reset_slave_arr) based on a racy
inspection of the active aggregator state while it is in flux.
Also, the description of the issue says "The best aggregator in
ad_agg_selection_logic has not changed, no need to update slave arr,"
but the change above does the opposite, and will set update_slave_arr
when the aggregator has not changed (update_slave_arr remains false at
return of ad_agg_selection_logic).
I believe I understand the described problem, but I don't see
how the patch fixes it. I suspect (but haven't tested) that the proper
fix is to acquire mode_lock in bond_update_slave_arr while calling
bond_3ad_get_active_agg_info to avoid conflict with the state machine.
-J
---
-Jay Vosburgh, jay.vosburgh@canonical.com
next prev parent reply other threads:[~2021-04-16 4:28 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-16 1:53 [PATCH] bonding: 3ad: update slave arr after initialize jinyiting
2021-04-16 4:28 ` Jay Vosburgh [this message]
2021-04-20 3:22 ` jin yiting
2021-04-20 5:04 ` Jay Vosburgh
2021-04-21 3:34 ` jin yiting
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=17733.1618547307@famine \
--to=jay.vosburgh@canonical.com \
--cc=andy@greyhouse.net \
--cc=davem@davemloft.net \
--cc=jinyiting@huawei.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=security@kernel.org \
--cc=vfalico@gmail.com \
--cc=wangxiaogang3@huawei.com \
--cc=xuhanbing@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).