• Dave Jones's avatar
    bond: take rcu lock in netpoll_send_skb_on_dev · 6fe94878
    Dave Jones authored
    The bonding driver lacks the rcu lock when it calls down into
    netdev_lower_get_next_private_rcu from bond_poll_controller, which
    results in a trace like:
    
    WARNING: CPU: 2 PID: 179 at net/core/dev.c:6567 netdev_lower_get_next_private_rcu+0x34/0x40
    CPU: 2 PID: 179 Comm: kworker/u16:15 Not tainted 4.19.0-rc5-backup+ #1
    Workqueue: bond0 bond_mii_monitor
    RIP: 0010:netdev_lower_get_next_private_rcu+0x34/0x40
    Code: 48 89 fb e8 fe 29 63 ff 85 c0 74 1e 48 8b 45 00 48 81 c3 c0 00 00 00 48 8b 00 48 39 d8 74 0f 48 89 45 00 48 8b 40 f8 5b 5d c3 <0f> 0b eb de 31 c0 eb f5 0f 1f 40 00 0f 1f 44 00 00 48 8>
    RSP: 0018:ffffc9000087fa68 EFLAGS: 00010046
    RAX: 0000000000000000 RBX: ffff880429614560 RCX: 0000000000000000
    RDX: 0000000000000001 RSI: 00000000ffffffff RDI: ffffffffa184ada0
    RBP: ffffc9000087fa80 R08: 0000000000000001 R09: 0000000000000000
    R10: ffffc9000087f9f0 R11: ffff880429798040 R12: ffff8804289d5980
    R13: ffffffffa1511f60 R14: 00000000000000c8 R15: 00000000ffffffff
    FS:  0000000000000000(0000) GS:ffff88042f880000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007f4b78fce180 CR3: 000000018180f006 CR4: 00000000001606e0
    Call Trace:
     bond_poll_controller+0x52/0x170
     netpoll_poll_dev+0x79/0x290
     netpoll_send_skb_on_dev+0x158/0x2c0
     netpoll_send_udp+0x2d5/0x430
     write_ext_msg+0x1e0/0x210
     console_unlock+0x3c4/0x630
     vprintk_emit+0xfa/0x2f0
     printk+0x52/0x6e
     ? __netdev_printk+0x12b/0x220
     netdev_info+0x64/0x80
     ? bond_3ad_set_carrier+0xe9/0x180
     bond_select_active_slave+0x1fc/0x310
     bond_mii_monitor+0x709/0x9b0
     process_one_work+0x221/0x5e0
     worker_thread+0x4f/0x3b0
     kthread+0x100/0x140
     ? process_one_work+0x5e0/0x5e0
     ? kthread_delayed_work_timer_fn+0x90/0x90
     ret_from_fork+0x24/0x30
    
    We're also doing rcu dereferences a layer up in netpoll_send_skb_on_dev
    before we call down into netpoll_poll_dev, so just take the lock there.
    Suggested-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
    Signed-off-by: default avatarDave Jones <davej@codemonkey.org.uk>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    6fe94878
netpoll.c 19 KB