Messages in this thread Patch in this message | | | Subject | PATCH: hash-table corruption in bond_alb.c | Date | Fri, 6 Jan 2006 13:49:10 -0500 | From | "ODonnell, Michael" <> |
| |
Hello,
Our systems have been crashing during testing of PCI HotPlug support in the various networking components. We've faulted in the bonding driver due to a bug in bond_alb.c:tlb_clear_slave()
In that routine, the last modification to the TLB hash table is made without protection of the lock, allowing a race that can lead tlb_choose_channel() to select an invalid table element.
Our patch file is included below.
Thanks, --Michael O'Donnell, Stratus Technologies, Maynard, MA USA
Signed-off-by: Michael O'Donnell <Michael.ODonnell at stratus dot com>
--- drivers/net/bonding/bond_alb.c.orig 2006-01-06 10:28:33.000000000 -0500 +++ drivers/net/bonding/bond_alb.c 2006-01-06 10:30:06.000000000 -0500 @@ -30,20 +30,23 @@ * handling required for ALB/TLB. * * 2003/12/01 - Shmulik Hen <shmulik.hen at intel dot com> * - Code cleanup and style changes * * 2003/12/30 - Amir Noam <amir.noam at intel dot com> * - Fixed: Cannot remove and re-enslave the original active slave. * * 2004/01/14 - Shmulik Hen <shmulik.hen at intel dot com> * - Add capability to tag self generated packets in ALB/TLB modes. + * + * 2005/12/02 - Michael O'Donnell <Michael.ODonnell at stratus dot com> + * - Stratus88746: tlb_clear_slave() must tlb_init_slave() while locked. */ //#define BONDING_DEBUG 1 #include <linux/skbuff.h> #include <linux/netdevice.h> #include <linux/etherdevice.h> #include <linux/pkt_sched.h> #include <linux/spinlock.h> #include <linux/slab.h> @@ -181,23 +184,23 @@ static void tlb_clear_slave(struct bondi /* clear slave from tx_hashtbl */ tx_hash_table = BOND_ALB_INFO(bond).tx_hashtbl; index = SLAVE_TLB_INFO(slave).head; while (index != TLB_NULL_INDEX) { u32 next_index = tx_hash_table[index].next; tlb_init_table_entry(&tx_hash_table[index], save_load); index = next_index; } - _unlock_tx_hashtbl(bond); + tlb_init_slave(slave); /* Stratus88746: do this before unlocking */ - tlb_init_slave(slave); + _unlock_tx_hashtbl(bond); } /* Must be called before starting the monitor timer */ static int tlb_initialize(struct bonding *bond) { struct alb_bond_info *bond_info = &(BOND_ALB_INFO(bond)); int size = TLB_HASH_TABLE_SIZE * sizeof(struct tlb_client_info); int i; spin_lock_init(&(bond_info->tx_hashtbl_lock)); - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |