linux/drivers/net
Nikolay Aleksandrov 4f5474e7fd bonding: fix igmp_retrans type and two related races
First the type of igmp_retrans (which is the actual counter of
igmp_resend parameter) is changed to u8 to be able to store values up
to 255 (as per documentation). There are two races that were hidden
there and which are easy to trigger after the previous fix, the first is
between bond_resend_igmp_join_requests and bond_change_active_slave
where igmp_retrans is set and can be altered by the periodic. The second
race condition is between multiple running instances of the periodic
(upon execution it can be scheduled again for immediate execution which
can cause the counter to go < 0 which in the unsigned case leads to
unnecessary igmp retransmissions).
Since in bond_change_active_slave bond->lock is held for reading and
curr_slave_lock for writing, we use curr_slave_lock for mutual
exclusion. We can't drop them as there're cases where RTNL is not held
when bond_change_active_slave is called. RCU is unlocked in
bond_resend_igmp_join_requests before getting curr_slave_lock since we
don't need it there and it's pointless to delay.
The decrement is moved inside the "if" block because if we decrement
unconditionally there's still a possibility for a race condition although
it is much more difficult to hit (many changes have to happen in
a very short period in order to trigger) which in the case of 3 parallel
running instances of this function and igmp_retrans == 1
(with check bond->igmp_retrans-- > 1) is:
f1 passes, doesn't re-schedule, but decrements - igmp_retrans = 0
f2 then passes, doesn't re-schedule, but decrements - igmp_retrans = 255
f3 does the unnecessary retransmissions.

Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-06-13 02:33:37 -07:00
..
appletalk appletalk: remove "config IPDDP_DECAP" 2013-03-22 10:21:09 -04:00
arcnet drivers/net: use module_pcmcia_driver() in pcmcia drivers 2013-03-15 12:27:33 -07:00
bonding bonding: fix igmp_retrans type and two related races 2013-06-13 02:33:37 -07:00
caif caif: CAIF_VIRTIO should depend on HAS_DMA 2013-05-11 16:28:24 -07:00
can net: can: peak_usb: Do not do dma on the stack 2013-06-03 14:05:32 +02:00
cris
dsa
ethernet net: ethernet: stmicro: stmmac: Fix compile error when STMMAC_XMIT_DEBUG used 2013-06-13 01:30:16 -07:00
fddi drivers:net: dma_alloc_coherent: use __GFP_ZERO instead of memset(, 0) 2013-03-17 12:50:24 -04:00
hamradio drivers/net: rename random32() to prandom_u32() 2013-05-07 18:38:27 -07:00
hippi rrunner.c: fix possible memory leak in rr_init_one() 2013-03-10 16:42:23 -04:00
hyperv hyperv: Fix vlan_proto setting in netvsc_recv_callback() 2013-05-31 17:33:40 -07:00
ieee802154 at86rf230: change irq handling to prevent lockups with edge type irq 2013-04-16 16:34:08 -04:00
irda net/irda: fix error return code in bfin_sir_open() 2013-05-08 13:13:29 -07:00
phy net: phy: fix a bug when verify the EEE support 2013-05-27 23:30:09 -07:00
plip net: add ETH_P_802_3_MIN 2013-03-28 01:20:42 -04:00
ppp Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2013-05-01 14:08:52 -07:00
slip
team team: move add to port list before port enablement 2013-06-12 00:56:27 -07:00
usb qmi_wwan/cdc_ether: let qmi_wwan handle the Huawei E1820 2013-06-11 02:43:22 -07:00
vmxnet3 net: vlan: add protocol argument to packet tagging functions 2013-04-19 14:46:06 -04:00
wan Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-02-26 20:16:07 -08:00
wimax
wireless b43: stop format string leaking into error msgs 2013-06-12 10:20:59 -04:00
xen-netback xen-netback: don't de-reference vif pointer after having called xenvif_put() 2013-06-13 01:25:24 -07:00
dummy.c
eql.c
ifb.c net: vlan: announce STAG offload capability in some drivers 2013-04-19 14:46:06 -04:00
Kconfig VXLAN: Fix vxlan stats handling. 2013-03-26 12:27:18 -04:00
LICENSE.SRC
loopback.c
macvlan.c macvlan: don't touch promisc without passthrough 2013-06-13 01:20:33 -07:00
macvtap.c net: switch to use skb_probe_transport_header() 2013-03-27 12:48:31 -04:00
Makefile
mdio.c
mii.c
netconsole.c netconsole: don't call __netpoll_cleanup() while atomic 2013-03-12 06:58:55 -04:00
ntb_netdev.c ntb_netdev: remove from list on exit 2013-05-15 10:58:14 -07:00
rionet.c
sb1000.c
Space.c
sungem_phy.c
tun.c tuntap: set SOCK_ZEROCOPY flag during open 2013-06-12 00:44:35 -07:00
veth.c net: vlan: announce STAG offload capability in some drivers 2013-04-19 14:46:06 -04:00
virtio_net.c virtio_net: enable napi for all possible queues during open 2013-05-23 00:10:59 -07:00
vxlan.c vxlan: Update vxlan fdb 'used' field after each usage 2013-05-18 12:53:39 -07:00
xen-netfront.c xen-netfront: reduce gso_max_size to account for max TCP header 2013-04-22 15:37:01 -04:00