linux/drivers
Nikolay Aleksandrov 9a72c2da69 bonding: fix div by zero while enslaving and transmitting
The problem is that the slave is first linked and slave_cnt is
incremented afterwards leading to a div by zero in the modes that use it
as a modulus. What happens is that in bond_start_xmit()
bond_has_slaves() is used to evaluate further transmission and it becomes
true after the slave is linked in, but when slave_cnt is used in the xmit
path it is still 0, so fetch it once and transmit based on that. Since
it is used only in round-robin and XOR modes, the fix is only for them.
Thanks to Eric Dumazet for pointing out the fault in my first try to fix
this.

Call trace (took it out of net-next kernel, but it's the same with net):
[46934.330038] divide error: 0000 [#1] SMP
[46934.330041] Modules linked in: bonding(O) 9p fscache
snd_hda_codec_generic crct10dif_pclmul
[46934.330041] bond0: Enslaving eth1 as an active interface with an up
link
[46934.330051]  ppdev joydev crc32_pclmul crc32c_intel 9pnet_virtio
ghash_clmulni_intel snd_hda_intel 9pnet snd_hda_controller parport_pc
serio_raw pcspkr snd_hda_codec parport virtio_balloon virtio_console
snd_hwdep snd_pcm pvpanic i2c_piix4 snd_timer i2ccore snd soundcore
virtio_blk virtio_net virtio_pci virtio_ring virtio ata_generic
pata_acpi floppy [last unloaded: bonding]
[46934.330053] CPU: 1 PID: 3382 Comm: ping Tainted: G           O
3.17.0-rc4+ #27
[46934.330053] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[46934.330054] task: ffff88005aebf2c0 ti: ffff88005b728000 task.ti:
ffff88005b728000
[46934.330059] RIP: 0010:[<ffffffffa0198c33>]  [<ffffffffa0198c33>]
bond_start_xmit+0x1c3/0x450 [bonding]
[46934.330060] RSP: 0018:ffff88005b72b7f8  EFLAGS: 00010246
[46934.330060] RAX: 0000000000000679 RBX: ffff88004b077000 RCX:
000000000000002a
[46934.330061] RDX: 0000000000000000 RSI: ffff88004b3f0500 RDI:
ffff88004b077940
[46934.330061] RBP: ffff88005b72b830 R08: 00000000000000c0 R09:
ffff88004a83e000
[46934.330062] R10: 000000000000ffff R11: ffff88004b1f12c0 R12:
ffff88004b3f0500
[46934.330062] R13: ffff88004b3f0500 R14: 000000000000002a R15:
ffff88004b077940
[46934.330063] FS:  00007fbd91a4c740(0000) GS:ffff88005f080000(0000)
knlGS:0000000000000000
[46934.330064] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[46934.330064] CR2: 00007f803a8bb000 CR3: 000000004b2c9000 CR4:
00000000000406e0
[46934.330069] Stack:
[46934.330071]  ffffffff811e6169 00000000e772fa05 ffff88004b077000
ffff88004b3f0500
[46934.330072]  ffffffff81d17d18 000000000000002a 0000000000000000
ffff88005b72b8a0
[46934.330073]  ffffffff81620108 ffffffff8161fe0e ffff88005b72b8c4
ffff88005b302000
[46934.330073] Call Trace:
[46934.330077]  [<ffffffff811e6169>] ?
__kmalloc_node_track_caller+0x119/0x300
[46934.330084]  [<ffffffff81620108>] dev_hard_start_xmit+0x188/0x410
[46934.330086]  [<ffffffff8161fe0e>] ? harmonize_features+0x2e/0x90
[46934.330088]  [<ffffffff81620b06>] __dev_queue_xmit+0x456/0x590
[46934.330089]  [<ffffffff81620c50>] dev_queue_xmit+0x10/0x20
[46934.330090]  [<ffffffff8168f022>] arp_xmit+0x22/0x60
[46934.330091]  [<ffffffff8168f090>] arp_send.part.16+0x30/0x40
[46934.330092]  [<ffffffff8168f1e5>] arp_solicit+0x115/0x2b0
[46934.330094]  [<ffffffff8160b5d7>] ? copy_skb_header+0x17/0xa0
[46934.330096]  [<ffffffff8162875a>] neigh_probe+0x4a/0x70
[46934.330097]  [<ffffffff8162979c>] __neigh_event_send+0xac/0x230
[46934.330098]  [<ffffffff8162a00b>] neigh_resolve_output+0x13b/0x220
[46934.330100]  [<ffffffff8165f120>] ? ip_forward_options+0x1c0/0x1c0
[46934.330101]  [<ffffffff81660478>] ip_finish_output+0x1f8/0x860
[46934.330102]  [<ffffffff81661f08>] ip_output+0x58/0x90
[46934.330103]  [<ffffffff81661602>] ? __ip_local_out+0xa2/0xb0
[46934.330104]  [<ffffffff81661640>] ip_local_out_sk+0x30/0x40
[46934.330105]  [<ffffffff81662a66>] ip_send_skb+0x16/0x50
[46934.330106]  [<ffffffff81662ad3>] ip_push_pending_frames+0x33/0x40
[46934.330107]  [<ffffffff8168854c>] raw_sendmsg+0x88c/0xa30
[46934.330110]  [<ffffffff81612b31>] ? skb_recv_datagram+0x41/0x60
[46934.330111]  [<ffffffff816875a9>] ? raw_recvmsg+0xa9/0x1f0
[46934.330113]  [<ffffffff816978d4>] inet_sendmsg+0x74/0xc0
[46934.330114]  [<ffffffff81697a9b>] ? inet_recvmsg+0x8b/0xb0
[46934.330115] bond0: Adding slave eth2
[46934.330116]  [<ffffffff8160357c>] sock_sendmsg+0x9c/0xe0
[46934.330118]  [<ffffffff81603248>] ?
move_addr_to_kernel.part.20+0x28/0x80
[46934.330121]  [<ffffffff811b4477>] ? might_fault+0x47/0x50
[46934.330122]  [<ffffffff816039b9>] ___sys_sendmsg+0x3a9/0x3c0
[46934.330125]  [<ffffffff8144a14a>] ? n_tty_write+0x3aa/0x530
[46934.330127]  [<ffffffff810d1ae4>] ? __wake_up+0x44/0x50
[46934.330129]  [<ffffffff81242b38>] ? fsnotify+0x238/0x310
[46934.330130]  [<ffffffff816048a1>] __sys_sendmsg+0x51/0x90
[46934.330131]  [<ffffffff816048f2>] SyS_sendmsg+0x12/0x20
[46934.330134]  [<ffffffff81738b29>] system_call_fastpath+0x16/0x1b
[46934.330144] Code: 48 8b 10 4c 89 ee 4c 89 ff e8 aa bc ff ff 31 c0 e9
1a ff ff ff 0f 1f 00 4c 89 ee 4c 89 ff e8 65 fb ff ff 31 d2 4c 89 ee 4c
89 ff <f7> b3 64 09 00 00 e8 02 bd ff ff 31 c0 e9 f2 fe ff ff 0f 1f 00
[46934.330146] RIP  [<ffffffffa0198c33>] bond_start_xmit+0x1c3/0x450
[bonding]
[46934.330146]  RSP <ffff88005b72b7f8>

CC: Eric Dumazet <eric.dumazet@gmail.com>
CC: Andy Gospodarek <andy@greyhouse.net>
CC: Jay Vosburgh <j.vosburgh@gmail.com>
CC: Veaceslav Falico <vfalico@gmail.com>
Fixes: 278b208375 ("bonding: initial RCU conversion")
Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-09-13 17:16:56 -04:00
..
accessibility
acpi Merge branches 'acpi-video' and 'acpi-ec' 2014-09-05 15:29:12 +02:00
amba
ata ahci_xgene: Fix the link down in first attempt for the APM X-Gene SoC AHCI SATA host controller driver. 2014-09-06 11:27:15 +09:00
atm Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2014-08-13 18:27:40 -06:00
auxdisplay
base Merge remote-tracking branches 'regmap/fix/cache', 'regmap/fix/debugfs' and 'regmap/fix/volatile' into regmap-linus 2014-08-31 13:23:45 +01:00
bcma bcma: add PCI ID for spromless BCM43217 2014-08-25 15:39:23 -04:00
block Merge branch 'akpm' (fixes from Andrew Morton) 2014-08-29 16:28:29 -07:00
bluetooth Bluetooth: Fix crash in the Marvell driver initialization codepath 2014-07-31 01:07:28 +02:00
bus bus: arm-ccn: Move event cleanup routine 2014-09-05 13:25:01 -07:00
cdrom
char virtio: rng: add derating factor for use by hwrng core 2014-08-15 10:26:01 +05:30
clk ARM: SoC platform changes for 3.17 2014-08-08 11:14:29 -07:00
clocksource ARM: SoC platform changes for 3.17 2014-08-08 11:14:29 -07:00
connector
cpufreq cpufreq: intel_pstate: Remove unneeded variable 2014-09-03 01:31:04 +02:00
cpuidle ARM: 8130/1: cpuidle/cpuidle-big_little: fix reading cpu id part number 2014-08-27 15:40:45 +01:00
crypto PCI changes for the v3.17 merge window (part 2): 2014-08-14 18:10:33 -06:00
dca
devfreq
dio
dma Merge branch 'for-linus' of git://git.infradead.org/users/vkoul/slave-dma 2014-08-11 07:14:01 -07:00
dma-buf dma-buf/fence: Fix a kerneldoc warning 2014-08-28 11:59:09 +05:30
edac Merge branch 'linux_next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-edac 2014-08-15 17:56:45 -06:00
eisa
extcon
firewire Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2014-08-06 09:38:14 -07:00
firmware firmware: Do not use WARN_ON(!spin_is_locked()) 2014-08-22 08:45:40 +01:00
fmc
gpio gpio: bt8xx: fix release of managed resources 2014-08-29 14:31:43 +02:00
gpu Merge branch 'linux-3.17' of git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-fixes 2014-09-05 09:27:33 +10:00
hid Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2014-08-27 09:38:06 -07:00
hsi HSI changes for the v3.17 series 2014-08-06 20:06:14 -07:00
hv Char / Misc driver patches for 3.17-rc1 2014-08-04 17:32:24 -07:00
hwmon hwmon: (ds1621) Update zbits after conversion rate change 2014-08-28 11:18:47 -07:00
hwspinlock hwspinlock: enable OMAP build for AM33xx, AM43xx & DRA7xx 2014-07-29 11:46:28 +03:00
i2c Revert "i2c: rcar: remove spinlock" 2014-09-04 19:59:42 +02:00
ide ide: use module_platform_driver() 2014-08-05 21:16:46 -07:00
idle intel_idle: Broadwell support 2014-08-15 17:06:40 -04:00
iio Staging driver patches for 3.17-rc1 2014-08-04 18:36:12 -07:00
infiniband mlx4: Fix wrong endianess access with QP context flags 2014-09-10 15:22:43 -07:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2014-09-03 17:26:12 -07:00
iommu iommu/core: Check for the right function pointer in iommu_map() 2014-08-19 00:19:26 +02:00
ipack
irqchip ARM: SoC platform changes for 3.17 2014-08-08 11:14:29 -07:00
isdn drivers: isdn: eicon: xdi_msg.h: Fix typo in #ifndef 2014-08-22 11:31:30 -07:00
leds Revert "leds: convert blink timer to workqueue" 2014-09-02 10:02:13 -07:00
lguest mm/vmalloc.c: clean up map_vm_area third argument 2014-08-06 18:01:19 -07:00
macintosh == Changes to existing drivers == 2014-08-07 17:23:16 -07:00
mailbox mailbox/omap: add a parent structure for every IP instance 2014-07-29 01:57:25 -07:00
mcb
md dm crypt: fix access beyond the end of allocated space 2014-08-28 14:24:09 -04:00
media media: use pci_zalloc_consistent 2014-08-08 15:57:28 -07:00
memory memory: Freescale CoreNet Coherency Fabric error reporting driver 2014-07-29 19:26:30 -05:00
memstick
message
mfd mfd: twl4030-power: Fix PM idle pin configuration to not conflict with regulators 2014-08-28 15:57:55 +01:00
misc mei: nfc: fix memory leak in error path 2014-08-25 13:16:23 -07:00
mmc PCI changes for the v3.17 merge window (part 2): 2014-08-14 18:10:33 -06:00
mtd Two trivial MTD updates for 3.17-rc4: 2014-09-06 12:12:09 -07:00
net bonding: fix div by zero while enslaving and transmitting 2014-09-13 17:16:56 -04:00
nfc
ntb
nubus
of of/irq: Fix lookup to use 'interrupts-extended' property first 2014-08-16 09:03:58 +01:00
oprofile
parisc
parport drivers/parport/parport_ip32.c: use PTR_ERR_OR_ZERO 2014-08-08 15:57:25 -07:00
pci PCI update for v3.17: 2014-09-03 08:45:48 -07:00
pcmcia Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc 2014-08-07 08:50:34 -07:00
phy ARM: SoC driver changes for 3.17 2014-08-08 11:34:32 -07:00
pinctrl pinctrl: exynos: Lock GPIOs as interrupts when used as EINTs 2014-08-21 07:24:29 -05:00
platform toshiba_acpi: fix and cleanup toshiba_kbd_bl_mode_store() 2014-09-03 10:45:12 -07:00
pnp ACPI / PNP: Fix acpi_pnp_match() 2014-07-30 00:23:09 +02:00
power ARM: SoC platform changes for 3.17 2014-08-08 11:14:29 -07:00
powercap powercap / RAPL: change domain detection message 2014-09-03 01:29:00 +02:00
pps
ps3
ptp PCI: Remove DEFINE_PCI_DEVICE_TABLE macro use 2014-08-12 12:15:14 -06:00
pwm pwm: Fix period and polarity in pwm_get() for non-perfect matches 2014-08-18 10:58:43 +02:00
rapidio PCI: Remove DEFINE_PCI_DEVICE_TABLE macro use 2014-08-12 12:15:14 -06:00
ras
regulator == Changes to existing drivers == 2014-08-07 17:17:39 -07:00
remoteproc
reset
rpmsg
rtc drivers/rtc/rtc-s5m.c: re-add support for devices without irq specified 2014-08-29 16:28:16 -07:00
s390 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux 2014-09-08 08:27:00 -07:00
sbus Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc 2014-08-05 18:57:18 -07:00
scsi Merge branch 'for-linus' of git://git.kernel.dk/linux-block 2014-08-29 11:21:49 -07:00
sfi
sh sh: intc: Confine SH_INTC to platforms that need it 2014-08-22 12:28:16 +09:00
sn
soc
spi Merge remote-tracking branch 'spi/fix/sh-msiof' into spi-linus 2014-08-31 13:46:19 +01:00
spmi
ssb ssb: add PCI ID 0x4351 2014-08-25 15:39:22 -04:00
staging USB fixes for 3.17-rc3 2014-08-29 12:10:03 -07:00
target SCSI misc on 20140806 2014-08-06 20:10:32 -07:00
tc
thermal
thunderbolt thunderbolt: Clear hops before overwriting 2014-08-26 14:54:48 -07:00
tty The branch contains the following device tree changes the v3.17 merge 2014-08-14 09:53:39 -06:00
uio
usb USB: fix build error with CONFIG_PM_RUNTIME disabled 2014-08-27 16:55:29 -07:00
uwb uwb/whci: use correct structure type name in sizeof 2014-08-01 15:48:08 -07:00
vfio drivers/vfio: Enable VFIO if EEH is not supported 2014-08-08 10:39:16 -06:00
vhost
video fbdev fixes for 3.17 2014-08-29 11:59:46 -07:00
virt
virtio virtio: Replace DEFINE_PCI_DEVICE_TABLE macro use 2014-07-27 21:07:15 +09:30
vlynq
vme vme: bridges: use pci_zalloc_consistent 2014-08-08 15:57:30 -07:00
w1
watchdog Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2014-08-07 08:47:00 -07:00
xen PCI: Remove DEFINE_PCI_DEVICE_TABLE macro use 2014-08-12 12:15:14 -06:00
zorro
Kconfig Char / Misc driver patches for 3.17-rc1 2014-08-04 17:32:24 -07:00
Makefile Driver core patches for 3.17-rc1 2014-08-04 18:34:04 -07:00