linux-stable/include/linux/if_team.h
Taehee Yoo ae9b15fbe6 net: fix stack overflow when LRO is disabled for virtual interfaces
When the virtual interface's feature is updated, it synchronizes the
updated feature for its own lower interface.
This propagation logic should be worked as the iteration, not recursively.
But it works recursively due to the netdev notification unexpectedly.
This problem occurs when it disables LRO only for the team and bonding
interface type.

       team0
         |
  +------+------+-----+-----+
  |      |      |     |     |
team1  team2  team3  ...  team200

If team0's LRO feature is updated, it generates the NETDEV_FEAT_CHANGE
event to its own lower interfaces(team1 ~ team200).
It is worked by netdev_sync_lower_features().
So, the NETDEV_FEAT_CHANGE notification logic of each lower interface
work iteratively.
But generated NETDEV_FEAT_CHANGE event is also sent to the upper
interface too.
upper interface(team0) generates the NETDEV_FEAT_CHANGE event for its own
lower interfaces again.
lower and upper interfaces receive this event and generate this
event again and again.
So, the stack overflow occurs.

But it is not the infinite loop issue.
Because the netdev_sync_lower_features() updates features before
generating the NETDEV_FEAT_CHANGE event.
Already synchronized lower interfaces skip notification logic.
So, it is just the problem that iteration logic is changed to the
recursive unexpectedly due to the notification mechanism.

Reproducer:

ip link add team0 type team
ethtool -K team0 lro on
for i in {1..200}
do
        ip link add team$i master team0 type team
        ethtool -K team$i lro on
done

ethtool -K team0 lro off

In order to fix it, the notifier_ctx member of bonding/team is introduced.

Reported-by: syzbot+60748c96cf5c6df8e581@syzkaller.appspotmail.com
Fixes: fd867d51f8 ("net/core: generic support for disabling netdev features down stack")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://lore.kernel.org/r/20230517143010.3596250-1-ap420073@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2023-05-19 22:46:37 -07:00

316 lines
7.9 KiB
C

/* SPDX-License-Identifier: GPL-2.0-or-later */
/*
* include/linux/if_team.h - Network team device driver header
* Copyright (c) 2011 Jiri Pirko <jpirko@redhat.com>
*/
#ifndef _LINUX_IF_TEAM_H_
#define _LINUX_IF_TEAM_H_
#include <linux/netpoll.h>
#include <net/sch_generic.h>
#include <linux/types.h>
#include <uapi/linux/if_team.h>
struct team_pcpu_stats {
u64_stats_t rx_packets;
u64_stats_t rx_bytes;
u64_stats_t rx_multicast;
u64_stats_t tx_packets;
u64_stats_t tx_bytes;
struct u64_stats_sync syncp;
u32 rx_dropped;
u32 tx_dropped;
u32 rx_nohandler;
};
struct team;
struct team_port {
struct net_device *dev;
struct hlist_node hlist; /* node in enabled ports hash list */
struct list_head list; /* node in ordinary list */
struct team *team;
int index; /* index of enabled port. If disabled, it's set to -1 */
bool linkup; /* either state.linkup or user.linkup */
struct {
bool linkup;
u32 speed;
u8 duplex;
} state;
/* Values set by userspace */
struct {
bool linkup;
bool linkup_enabled;
} user;
/* Custom gennetlink interface related flags */
bool changed;
bool removed;
/*
* A place for storing original values of the device before it
* become a port.
*/
struct {
unsigned char dev_addr[MAX_ADDR_LEN];
unsigned int mtu;
} orig;
#ifdef CONFIG_NET_POLL_CONTROLLER
struct netpoll *np;
#endif
s32 priority; /* lower number ~ higher priority */
u16 queue_id;
struct list_head qom_list; /* node in queue override mapping list */
struct rcu_head rcu;
long mode_priv[];
};
static inline struct team_port *team_port_get_rcu(const struct net_device *dev)
{
return rcu_dereference(dev->rx_handler_data);
}
static inline bool team_port_enabled(struct team_port *port)
{
return port->index != -1;
}
static inline bool team_port_txable(struct team_port *port)
{
return port->linkup && team_port_enabled(port);
}
static inline bool team_port_dev_txable(const struct net_device *port_dev)
{
struct team_port *port;
bool txable;
rcu_read_lock();
port = team_port_get_rcu(port_dev);
txable = port ? team_port_txable(port) : false;
rcu_read_unlock();
return txable;
}
#ifdef CONFIG_NET_POLL_CONTROLLER
static inline void team_netpoll_send_skb(struct team_port *port,
struct sk_buff *skb)
{
netpoll_send_skb(port->np, skb);
}
#else
static inline void team_netpoll_send_skb(struct team_port *port,
struct sk_buff *skb)
{
}
#endif
struct team_mode_ops {
int (*init)(struct team *team);
void (*exit)(struct team *team);
rx_handler_result_t (*receive)(struct team *team,
struct team_port *port,
struct sk_buff *skb);
bool (*transmit)(struct team *team, struct sk_buff *skb);
int (*port_enter)(struct team *team, struct team_port *port);
void (*port_leave)(struct team *team, struct team_port *port);
void (*port_change_dev_addr)(struct team *team, struct team_port *port);
void (*port_enabled)(struct team *team, struct team_port *port);
void (*port_disabled)(struct team *team, struct team_port *port);
};
extern int team_modeop_port_enter(struct team *team, struct team_port *port);
extern void team_modeop_port_change_dev_addr(struct team *team,
struct team_port *port);
enum team_option_type {
TEAM_OPTION_TYPE_U32,
TEAM_OPTION_TYPE_STRING,
TEAM_OPTION_TYPE_BINARY,
TEAM_OPTION_TYPE_BOOL,
TEAM_OPTION_TYPE_S32,
};
struct team_option_inst_info {
u32 array_index;
struct team_port *port; /* != NULL if per-port */
};
struct team_gsetter_ctx {
union {
u32 u32_val;
const char *str_val;
struct {
const void *ptr;
u32 len;
} bin_val;
bool bool_val;
s32 s32_val;
} data;
struct team_option_inst_info *info;
};
struct team_option {
struct list_head list;
const char *name;
bool per_port;
unsigned int array_size; /* != 0 means the option is array */
enum team_option_type type;
int (*init)(struct team *team, struct team_option_inst_info *info);
int (*getter)(struct team *team, struct team_gsetter_ctx *ctx);
int (*setter)(struct team *team, struct team_gsetter_ctx *ctx);
};
extern void team_option_inst_set_change(struct team_option_inst_info *opt_inst_info);
extern void team_options_change_check(struct team *team);
struct team_mode {
const char *kind;
struct module *owner;
size_t priv_size;
size_t port_priv_size;
const struct team_mode_ops *ops;
enum netdev_lag_tx_type lag_tx_type;
};
#define TEAM_PORT_HASHBITS 4
#define TEAM_PORT_HASHENTRIES (1 << TEAM_PORT_HASHBITS)
#define TEAM_MODE_PRIV_LONGS 4
#define TEAM_MODE_PRIV_SIZE (sizeof(long) * TEAM_MODE_PRIV_LONGS)
struct team {
struct net_device *dev; /* associated netdevice */
struct team_pcpu_stats __percpu *pcpu_stats;
struct mutex lock; /* used for overall locking, e.g. port lists write */
/*
* List of enabled ports and their count
*/
int en_port_count;
struct hlist_head en_port_hlist[TEAM_PORT_HASHENTRIES];
struct list_head port_list; /* list of all ports */
struct list_head option_list;
struct list_head option_inst_list; /* list of option instances */
const struct team_mode *mode;
struct team_mode_ops ops;
bool user_carrier_enabled;
bool queue_override_enabled;
struct list_head *qom_lists; /* array of queue override mapping lists */
bool port_mtu_change_allowed;
bool notifier_ctx;
struct {
unsigned int count;
unsigned int interval; /* in ms */
atomic_t count_pending;
struct delayed_work dw;
} notify_peers;
struct {
unsigned int count;
unsigned int interval; /* in ms */
atomic_t count_pending;
struct delayed_work dw;
} mcast_rejoin;
struct lock_class_key team_lock_key;
long mode_priv[TEAM_MODE_PRIV_LONGS];
};
static inline int team_dev_queue_xmit(struct team *team, struct team_port *port,
struct sk_buff *skb)
{
BUILD_BUG_ON(sizeof(skb->queue_mapping) !=
sizeof(qdisc_skb_cb(skb)->slave_dev_queue_mapping));
skb_set_queue_mapping(skb, qdisc_skb_cb(skb)->slave_dev_queue_mapping);
skb->dev = port->dev;
if (unlikely(netpoll_tx_running(team->dev))) {
team_netpoll_send_skb(port, skb);
return 0;
}
return dev_queue_xmit(skb);
}
static inline struct hlist_head *team_port_index_hash(struct team *team,
int port_index)
{
return &team->en_port_hlist[port_index & (TEAM_PORT_HASHENTRIES - 1)];
}
static inline struct team_port *team_get_port_by_index(struct team *team,
int port_index)
{
struct team_port *port;
struct hlist_head *head = team_port_index_hash(team, port_index);
hlist_for_each_entry(port, head, hlist)
if (port->index == port_index)
return port;
return NULL;
}
static inline int team_num_to_port_index(struct team *team, unsigned int num)
{
int en_port_count = READ_ONCE(team->en_port_count);
if (unlikely(!en_port_count))
return 0;
return num % en_port_count;
}
static inline struct team_port *team_get_port_by_index_rcu(struct team *team,
int port_index)
{
struct team_port *port;
struct hlist_head *head = team_port_index_hash(team, port_index);
hlist_for_each_entry_rcu(port, head, hlist)
if (port->index == port_index)
return port;
return NULL;
}
static inline struct team_port *
team_get_first_port_txable_rcu(struct team *team, struct team_port *port)
{
struct team_port *cur;
if (likely(team_port_txable(port)))
return port;
cur = port;
list_for_each_entry_continue_rcu(cur, &team->port_list, list)
if (team_port_txable(cur))
return cur;
list_for_each_entry_rcu(cur, &team->port_list, list) {
if (cur == port)
break;
if (team_port_txable(cur))
return cur;
}
return NULL;
}
extern int team_options_register(struct team *team,
const struct team_option *option,
size_t option_count);
extern void team_options_unregister(struct team *team,
const struct team_option *option,
size_t option_count);
extern int team_mode_register(const struct team_mode *mode);
extern void team_mode_unregister(const struct team_mode *mode);
#define TEAM_DEFAULT_NUM_TX_QUEUES 16
#define TEAM_DEFAULT_NUM_RX_QUEUES 16
#define MODULE_ALIAS_TEAM_MODE(kind) MODULE_ALIAS("team-mode-" kind)
#endif /* _LINUX_IF_TEAM_H_ */