Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 49b7624e authored by Veaceslav Falico's avatar Veaceslav Falico Committed by David S. Miller
Browse files

bonding: fix __get_active_agg() RCU logic 



Currently, the implementation is meaningless - once again, we take the
slave structure and use it after we've exited RCU critical section.

Fix this by removing the rcu_read_lock() from __get_active_agg(), and
ensuring that all its callers are holding RCU.

Fixes: be79bd04 ("bonding: add RCU for bond_3ad_state_machine_handler()")
CC: dingtianhong@huawei.com
CC: Jay Vosburgh <fubar@us.ibm.com>
CC: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: default avatarVeaceslav Falico <vfalico@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 768b9549

drivers/net/bonding/bond_3ad.c

+4 −6
Original line number Diff line number Diff line
@@ -678,6 +678,8 @@ static u32 __get_agg_bandwidth(struct aggregator *aggregator) 
/**

 * __get_active_agg - get the current active aggregator

 * @aggregator: the aggregator we're looking at

 *

 * Caller must hold RCU lock.

 */

static struct aggregator *__get_active_agg(struct aggregator *aggregator)

{
@@ -685,13 +687,9 @@ static struct aggregator *__get_active_agg(struct aggregator *aggregator) 
	struct list_head *iter;

	struct slave *slave;



	rcu_read_lock();

	bond_for_each_slave_rcu(bond, slave, iter)

		if (SLAVE_AD_INFO(slave).aggregator.is_active) {

			rcu_read_unlock();

		if (SLAVE_AD_INFO(slave).aggregator.is_active)

			return &(SLAVE_AD_INFO(slave).aggregator);

		}

	rcu_read_unlock();



	return NULL;

}
@@ -1499,11 +1497,11 @@ static void ad_agg_selection_logic(struct aggregator *agg) 
	struct slave *slave;

	struct port *port;



	rcu_read_lock();

	origin = agg;

	active = __get_active_agg(agg);

	best = (active && agg_device_up(active)) ? active : NULL;



	rcu_read_lock();

	bond_for_each_slave_rcu(bond, slave, iter) {

		agg = &(SLAVE_AD_INFO(slave).aggregator);