From nobody Sun Feb 8 19:24:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5AEDDC761A6 for ; Tue, 28 Mar 2023 03:41:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232644AbjC1DlZ (ORCPT ); Mon, 27 Mar 2023 23:41:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49572 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232546AbjC1DlX (ORCPT ); Mon, 27 Mar 2023 23:41:23 -0400 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4C10C198B; Mon, 27 Mar 2023 20:41:19 -0700 (PDT) X-UUID: b1670cf888f84dab9788b343001e7cdb-20230328 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.20,REQID:4924d34c-98e4-4057-8ba2-3e0330e3e5fe,IP:-32 768,URL:-32768,TC:-32768,Content:-32768,EDM:-32768,RT:-32768,SF:-32768,FIL E:-32768,BULK:-32768,RULE:Release_Ham,ACTION:release,TS:0 X-CID-INFO: VERSION:1.1.20,REQID:4924d34c-98e4-4057-8ba2-3e0330e3e5fe,IP:-3276 8,URL:-32768,TC:-32768,Content:-32768,EDM:-32768,RT:-32768,SF:-32768,FILE: -32768,BULK:-32768,RULE:Release_Ham,ACTION:release,TS:0 X-CID-META: VersionHash:25b5999,CLOUDID:nil,BulkID:nil,BulkQuantity:0,Recheck: 0,SF:nil,TC:nil,Content:nil,EDM:nil,IP:nil,URL:nil,File:nil,Bulk:nil,QS:ni l,BEC:nil,COL:0,OSI:0,OSA:0,AV:0 X-CID-BVR: 0 X-UUID: b1670cf888f84dab9788b343001e7cdb-20230328 X-User: sujing@kylinos.cn Received: from localhost.localdomain [(210.12.40.82)] by mailgw (envelope-from ) (Generic MTA) with ESMTP id 1177435070; Tue, 28 Mar 2023 11:40:46 +0800 From: sujing To: davem@davemloft.net Cc: edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, andy@greyhouse.net, j.vosburgh@gmail.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, sujing Subject: [PATCH] net: bonding: avoid use-after-free with tx_hashtbl/rx_hashtbl Date: Tue, 28 Mar 2023 11:40:37 +0800 Message-Id: <20230328034037.2076930-1-sujing@kylinos.cn> X-Mailer: git-send-email 2.23.0 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" In bonding mode 6 (Balance-alb), there are some potential race conditions between the 'bond_close' process and the tx/rx processes that use tx_hashtbl/rx_hashtbl, which may lead to use-after-free. For instance, when the bond6 device is in the 'bond_close' process while some backlogged packets from upper level are transmitted to 'bond_start_xmit', there is a spinlock contention between 'tlb_deinitialize' and 'tlb_choose_channel'. If 'tlb_deinitialize' preempts the lock before 'tlb_choose_channel', a NULL pointer kernel panic will be triggered. Here's the timeline: bond_close ------------------ bond_start_xmit bond_alb_deinitialize ------- __bond_start_xmit tlb_deinitialize ------------ bond_alb_xmit spin_lock_bh ---------------- bond_xmit_alb_slave_get tx_hashtbl =3D NULL ----------- tlb_choose_channel spin_unlock_bh -------------- //wait for spin_lock_bh ------------------------------ spin_lock_bh ------------------------------ __tlb_choose_channel causing kernel panic =3D=3D=3D=3D=3D=3D=3D=3D> tx_hashtbl[hash_index].tx_s= lave ------------------------------ spin_unlock_bh Signed-off-by: sujing --- drivers/net/bonding/bond_alb.c | 32 +++++++++------------------ drivers/net/bonding/bond_main.c | 39 +++++++++++++++++++++++++++------ include/net/bond_alb.h | 5 ++++- 3 files changed, 46 insertions(+), 30 deletions(-) diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index b9dbad3a8af8..f6ff5ea835c4 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -71,7 +71,7 @@ static inline u8 _simple_hash(const u8 *hash_start, int h= ash_size) =20 /*********************** tlb specific functions **************************= */ =20 -static inline void tlb_init_table_entry(struct tlb_client_info *entry, int= save_load) +void tlb_init_table_entry(struct tlb_client_info *entry, int save_load) { if (save_load) { entry->load_history =3D 1 + entry->tx_bytes / @@ -269,8 +269,8 @@ static void rlb_update_entry_from_arp(struct bonding *b= ond, struct arp_pkt *arp) spin_unlock_bh(&bond->mode_lock); } =20 -static int rlb_arp_recv(const struct sk_buff *skb, struct bonding *bond, - struct slave *slave) +int rlb_arp_recv(const struct sk_buff *skb, struct bonding *bond, + struct slave *slave) { struct arp_pkt *arp, _arp; =20 @@ -756,7 +756,7 @@ static void rlb_init_table_entry_src(struct rlb_client_= info *entry) entry->src_next =3D RLB_NULL_INDEX; } =20 -static void rlb_init_table_entry(struct rlb_client_info *entry) +void rlb_init_table_entry(struct rlb_client_info *entry) { memset(entry, 0, sizeof(struct rlb_client_info)); rlb_init_table_entry_dst(entry); @@ -874,9 +874,6 @@ static int rlb_initialize(struct bonding *bond) =20 spin_unlock_bh(&bond->mode_lock); =20 - /* register to receive ARPs */ - bond->recv_probe =3D rlb_arp_recv; - return 0; } =20 @@ -888,7 +885,6 @@ static void rlb_deinitialize(struct bonding *bond) =20 kfree(bond_info->rx_hashtbl); bond_info->rx_hashtbl =3D NULL; - bond_info->rx_hashtbl_used_head =3D RLB_NULL_INDEX; =20 spin_unlock_bh(&bond->mode_lock); } @@ -1303,7 +1299,7 @@ static bool alb_determine_nd(struct sk_buff *skb, str= uct bonding *bond) =20 /************************ exported alb functions ************************/ =20 -int bond_alb_initialize(struct bonding *bond, int rlb_enabled) +int bond_alb_initialize(struct bonding *bond) { int res; =20 @@ -1311,15 +1307,10 @@ int bond_alb_initialize(struct bonding *bond, int r= lb_enabled) if (res) return res; =20 - if (rlb_enabled) { - res =3D rlb_initialize(bond); - if (res) { - tlb_deinitialize(bond); - return res; - } - bond->alb_info.rlb_enabled =3D 1; - } else { - bond->alb_info.rlb_enabled =3D 0; + res =3D rlb_initialize(bond); + if (res) { + tlb_deinitialize(bond); + return res; } =20 return 0; @@ -1327,12 +1318,9 @@ int bond_alb_initialize(struct bonding *bond, int rl= b_enabled) =20 void bond_alb_deinitialize(struct bonding *bond) { - struct alb_bond_info *bond_info =3D &(BOND_ALB_INFO(bond)); - tlb_deinitialize(bond); =20 - if (bond_info->rlb_enabled) - rlb_deinitialize(bond); + rlb_deinitialize(bond); } =20 static netdev_tx_t bond_do_alb_xmit(struct sk_buff *skb, struct bonding *b= ond, diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_mai= n.c index 236e5219c811..8fcb5d3ac0a2 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -4217,6 +4217,7 @@ static int bond_open(struct net_device *bond_dev) struct bonding *bond =3D netdev_priv(bond_dev); struct list_head *iter; struct slave *slave; + int i; =20 if (BOND_MODE(bond) =3D=3D BOND_MODE_ROUNDROBIN && !bond->rr_tx_counter) { bond->rr_tx_counter =3D alloc_percpu(u32); @@ -4239,11 +4240,29 @@ static int bond_open(struct net_device *bond_dev) } =20 if (bond_is_lb(bond)) { - /* bond_alb_initialize must be called before the timer - * is started. - */ - if (bond_alb_initialize(bond, (BOND_MODE(bond) =3D=3D BOND_MODE_ALB))) - return -ENOMEM; + struct alb_bond_info *bond_info =3D &(BOND_ALB_INFO(bond)); + + spin_lock_bh(&bond->mode_lock); + + for (i =3D 0; i < TLB_HASH_TABLE_SIZE; i++) + tlb_init_table_entry(&bond_info->tx_hashtbl[i], 0); + + spin_unlock_bh(&bond->mode_lock); + + if (BOND_MODE(bond) =3D=3D BOND_MODE_ALB) { + bond->alb_info.rlb_enabled =3D 1; + spin_lock_bh(&bond->mode_lock); + + bond_info->rx_hashtbl_used_head =3D RLB_NULL_INDEX; + for (i =3D 0; i < RLB_HASH_TABLE_SIZE; i++) + rlb_init_table_entry(bond_info->rx_hashtbl + i); + + spin_unlock_bh(&bond->mode_lock); + bond->recv_probe =3D rlb_arp_recv; + } else { + bond->alb_info.rlb_enabled =3D 0; + } + if (bond->params.tlb_dynamic_lb || BOND_MODE(bond) =3D=3D BOND_MODE_ALB) queue_delayed_work(bond->wq, &bond->alb_work, 0); } @@ -4279,8 +4298,6 @@ static int bond_close(struct net_device *bond_dev) =20 bond_work_cancel_all(bond); bond->send_peer_notif =3D 0; - if (bond_is_lb(bond)) - bond_alb_deinitialize(bond); bond->recv_probe =3D NULL; =20 if (bond_uses_primary(bond)) { @@ -5854,6 +5871,8 @@ static void bond_uninit(struct net_device *bond_dev) struct list_head *iter; struct slave *slave; =20 + bond_alb_deinitialize(bond); + bond_netpoll_cleanup(bond_dev); =20 /* Release the bonded slaves */ @@ -6295,6 +6314,12 @@ static int bond_init(struct net_device *bond_dev) bond_dev->addr_assign_type =3D=3D NET_ADDR_PERM) eth_hw_addr_random(bond_dev); =20 + /* bond_alb_initialize must be called before the timer + * is started. + */ + if (bond_alb_initialize(bond)) + return -ENOMEM; + return 0; } =20 diff --git a/include/net/bond_alb.h b/include/net/bond_alb.h index 9dc082b2d543..9fd16e20ef82 100644 --- a/include/net/bond_alb.h +++ b/include/net/bond_alb.h @@ -150,7 +150,7 @@ struct alb_bond_info { */ }; =20 -int bond_alb_initialize(struct bonding *bond, int rlb_enabled); +int bond_alb_initialize(struct bonding *bond); void bond_alb_deinitialize(struct bonding *bond); int bond_alb_init_slave(struct bonding *bond, struct slave *slave); void bond_alb_deinit_slave(struct bonding *bond, struct slave *slave); @@ -165,5 +165,8 @@ struct slave *bond_xmit_tlb_slave_get(struct bonding *b= ond, void bond_alb_monitor(struct work_struct *); int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr); void bond_alb_clear_vlan(struct bonding *bond, unsigned short vlan_id); +int rlb_arp_recv(const struct sk_buff *skb, struct bonding *bond, struct s= lave *slave); +void tlb_init_table_entry(struct tlb_client_info *entry, int save_load); +void rlb_init_table_entry(struct rlb_client_info *entry); #endif /* _NET_BOND_ALB_H */ =20 --=20 2.27.0