litmus-rt.git/drivers/net/bonding, branch linux-tip

bonding: fix a race in IGMP handling

2010-11-18T17:30:42+00:00

RCU conversion in IGMP code done in net-next-2.6 raised a race in
__bond_resend_igmp_join_requests().

It iterates in_dev->mc_list without appropriate protection (RTNL, or
read_lock on in_dev->mc_list_lock).

Another cpu might delete an entry while we use it and trigger a fault.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

bonding: Fix lockdep warning after bond_vlan_rx_register()

2010-10-27T21:24:07+00:00

Fix lockdep warning:
[   52.991402] ======================================================
[   52.991511] [ INFO: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected ]
[   52.991569] 2.6.36-04573-g4b60626-dirty #65
[   52.991622] ------------------------------------------------------
[   52.991696] ip/4842 [HC0[0]:SC0[4]:HE1:SE0] is trying to acquire:
[   52.991758]  (&bond->lock){++++..}, at: [] bond_set_multicast_list+0x60/0x2c0 [bonding]
[   52.991966]
[   52.991967] and this task is already holding:
[   52.992008]  (&bonding_netdev_addr_lock_key){+.....}, at: [] dev_mc_sync+0x50/0xa0
[   52.992008] which would create a new lock dependency:
[   52.992008]  (&bonding_netdev_addr_lock_key){+.....} -> (&bond->lock){++++..}
[   52.992008]
[   52.992008] but this new dependency connects a SOFTIRQ-irq-safe lock:
[   52.992008]  (&(&mc->mca_lock)->rlock){+.-...}
[   52.992008] ... which became SOFTIRQ-irq-safe at:
[   52.992008]   [] __lock_acquire+0x96b/0x1960
[   52.992008]   [] lock_acquire+0x7e/0xf0
[   52.992008]   [] _raw_spin_lock_bh+0x3d/0x50
[   52.992008]   [] mld_ifc_timer_expire+0xf0/0x280
[   52.992008]   [] run_timer_softirq+0x146/0x310
[   52.992008]   [] __do_softirq+0xad/0x1c0
[   52.992008]
[   52.992008] to a SOFTIRQ-irq-unsafe lock:
[   52.992008]  (&bond->lock){++++..}
[   52.992008] ... which became SOFTIRQ-irq-unsafe at:
[   52.992008] ...  [] __lock_acquire+0x9bb/0x1960
[   52.992008]   [] lock_acquire+0x7e/0xf0
[   52.992008]   [] _raw_write_lock+0x38/0x50
[   52.992008]   [] bond_vlan_rx_register+0x24/0x70 [bonding]
[   52.992008]   [] register_vlan_dev+0xc0/0x280
[   52.992008]   [] vlan_newlink+0xaa/0xd0
[   52.992008]   [] rtnl_newlink+0x404/0x490
[   52.992008]   [] rtnetlink_rcv_msg+0x1e5/0x220
[   52.992008]   [] netlink_rcv_skb+0x8e/0xb0
[   52.992008]   [] rtnetlink_rcv+0x1c/0x30
[   52.992008]   [] netlink_unicast+0x24b/0x290
[   52.992008]   [] netlink_sendmsg+0x1f7/0x310
[   52.992008]   [] sock_sendmsg+0xac/0xe0
[   52.992008]   [] sys_sendmsg+0x130/0x230
[   52.992008]   [] sys_socketcall+0xde/0x280
[   52.992008]   [] sysenter_do_call+0x12/0x36
[   52.992008]
[   52.992008] other info that might help us debug this:
...
[ Full info at netdev: Wed, 27 Oct 2010 12:24:30 +0200
  Subject: [BUG net-2.6 vlan/bonding] lockdep splats ]

Use BH variant of write_lock(&bond->lock) (as elsewhere in bond_main)
to prevent this dependency.

Fixes commit f35188faa0fbabefac476536994f4b6f3677380f [v2.6.36]

Reported-by: Eric Dumazet 
Tested-by: Eric Dumazet 
Signed-off-by: Jarek Poplawski 
Acked-by: Eric Dumazet 
Cc: Jay Vosburgh

bonding: cleanup: remove braces from single block statements

2010-10-21T10:09:49+00:00

checkpatch.pl cleanup : Remove braces from single statement
blocks.

Signed-off-by: Bandan Das 
Signed-off-by: David S. Miller

bonding: cleanup : add space around operators

2010-10-21T10:09:49+00:00

checkpatch.pl cleanup: Added spaces around operators at various places.
Also fixed some c99 style comments that I came across.

Signed-off-by: Bandan Das 
Signed-off-by: David S. Miller

bonding: make release_and_destroy static

2010-10-21T10:09:46+00:00

Only used in main file.

Signed-off-by: Stephen Hemminger 
Acked-by: Andy Gospodarek 
Signed-off-by: Jay Vosburgh 
Signed-off-by: David S. Miller

bonding: make bond_resend_igmp_join_requests_delayed static

2010-10-21T10:09:43+00:00

Signed-off-by: Stephen Hemminger 
Acked-by: Flavio Leitner 
Signed-off-by: Jay Vosburgh 
Signed-off-by: David S. Miller

netpoll: Remove netpoll blocking from uninit path

2010-10-20T08:44:29+00:00

Some recent testing in netpoll with bonding showed this backtrace

 ------------[ cut here ]------------
 kernel BUG at drivers/net/bonding/bonding.h:134!
 invalid opcode: 0000 [#1] SMP
 last sysfs file: /sys/devices/pci0000:00/0000:00:1d.2/usb7/devnum
 CPU 0
 Pid: 1876, comm: rmmod Not tainted 2.6.36-rc3+ #10 D26928/
 RIP: 0010:[]  [] bond_uninit+0x6f4/0x7a0
 RSP: 0018:ffff88003b1b5d58  EFLAGS: 00010296
 RAX: ffff88003b9b6200 RBX: ffff8800373e8e00 RCX: 00000000000f4240
 RDX: 00000000ffffffff RSI: 0000000000000286 RDI: 0000000000000286
 RBP: ffff88003b1b5dc8 R08: 0000000000000000 R09: 00000001af7de920
 R10: 0000000000000000 R11: ffff880002495e98 R12: ffff880037922700
 R13: ffff880038c31000 R14: ffff880037922730 R15: 0000000000000286
 FS:  00007f90e6d72700(0000) GS:ffff880002400000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
 CR2: 000000346f0d9ad0 CR3: 000000003b263000 CR4: 00000000000006f0
 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
 Process rmmod (pid: 1876, threadinfo ffff88003b1b4000, task ffff88003b36aa80)
 Stack:
 00000000ffffffff ffff88003b1b5d7a ffff8800379221e8 ffff880037922000
 <0> ffff88003b1b5dc8 ffffffff813eb5fb ffff88003b1b5da8 0000000031b177a3
 <0> ffff88003b1b5da8 ffff880037922000 ffff88003b1b5e48 ffff88003b1b5e48
 Call Trace:
 [] ? rtmsg_ifinfo+0xcb/0xf0
 [] rollback_registered_many+0x168/0x280
 [] unregister_netdevice_many+0x19/0x80
 [] __rtnl_kill_links+0x63/0x90
 [] __rtnl_link_unregister+0x2b/0x60
 [] rtnl_link_unregister+0x1e/0x30
 [] bonding_exit+0x37/0x51 [bonding]
 [] sys_delete_module+0x19e/0x270
 [] ? audit_syscall_entry+0x252/0x280
 [] system_call_fastpath+0x16/0x1b
 RIP  [] bond_uninit+0x6f4/0x7a0 [bonding]
 RSP 
 ---[ end trace 1395ad691cea24d1 ]---

It occurs because of my recent netpoll blocking patches, which I added to avoid
recursive deadlock in the bonding driver.  It relies on some per cpu bits, but
the shutdown path forces some rescheduling as we cancel workqueues for the
driver and wait for some device refcounts.  If after the forced reschedule, we
wind up on a different cpu we trigger the bughalt in unblock_netpoll_tx.

The fix is to remove the netpoll block/unblock calls from bond_release_all.
This is safe to do because bond_uninit, which is called via ndo_uninit in
rollback_registered_many, doesn't occur until we send a NETDEV_UNREGISTER event,
which triggers netconsole to remove us as a netpoll client, so we are guaranteed
not to recurse into our own tx path here.

Signed-off-by: Neil Horman 
Reviewed-by: WANG Cong 
Signed-off-by: David S. Miller

bonding: Re-enable netpoll over bonding

2010-10-18T15:32:09+00:00

With the inclusion of previous fixup patches, netpoll over bonding apears to
work reliably with failover conditions.  This reverts Gospos previous commit
c22d7ac844f1cb9c6a5fd20f89ebadc2feef891b, and allows access again to the netpoll
functionality in the bonding driver.

Signed-off-by: Neil Horman 
Signed-off-by: David S. Miller

bonding: Fix deadlock in bonding driver resulting from internal locking when using netpoll

2010-10-18T15:32:07+00:00

The monitoring paths in the bonding driver take write locks that are shared by
the tx path.  If netconsole is in use, these paths can call printk which puts us
in the netpoll tx path, which, if netconsole is attached to the bonding driver,
result in deadlock (the xmit_lock guards are useless in netpoll_send_skb, as the
monitor paths in the bonding driver don't claim the xmit_lock, nor should they).
The solution is to use a per cpu flag internal to the driver to indicate when a
cpu is holding the lock in a path that might recusrse into the tx path for the
driver via netconsole.  By checking this flag on transmit, we can defer the
sending of the netconsole frames until a later time using the retransmit feature
of netpoll_send_skb that is triggered on the return code NETDEV_TX_BUSY.  I've
tested this and am able to transmit via netconsole while causing failover
conditions on the bond slave links.

Signed-off-by: Neil Horman 
Signed-off-by: David S. Miller

bonding: Fix bonding drivers improper modification of netpoll structure

2010-10-18T15:32:07+00:00

The bonding driver currently modifies the netpoll structure in its xmit path
while sending frames from netpoll.  This is racy, as other cpus can access the
netpoll structure in parallel. Since the bonding driver points np->dev to a
slave device, other cpus can inadvertently attempt to send data directly to
slave devices, leading to improper locking with the bonding master, lost frames,
and deadlocks.  This patch fixes that up.

This patch also removes the real_dev pointer from the netpoll structure as that
data is really only used by bonding in the poll_controller, and we can emulate
its behavior by check each slave for IS_UP.

Signed-off-by: Neil Horman 
Signed-off-by: David S. Miller