linux_dsm_epyc7002/drivers/net/bonding/bond_ipv6.c
Eric Dumazet db5dda9057 bonding: fix bond_inet6addr_event()
After commit ad1afb0039 (vlan_dev: VLAN 0 should be treated
as "no vlan tag" (802.1p packet)),
bond_inet6addr_event() might be called with a NULL bond->vlgrp pointer, and
a non empty bond->vlan_list. vlan_group_get_device() is dereferencing a NULL pointer.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2010-07-19 09:34:31 -07:00

221 lines
5.5 KiB
C

/*
* Copyright(c) 2008 Hewlett-Packard Development Company, L.P.
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* You should have received a copy of the GNU General Public License along
* with this program; if not, write to the Free Software Foundation, Inc.,
* 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
*
* The full GNU General Public License is included in this distribution in the
* file called LICENSE.
*
*/
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/types.h>
#include <linux/if_vlan.h>
#include <net/ipv6.h>
#include <net/ndisc.h>
#include <net/addrconf.h>
#include <net/netns/generic.h>
#include "bonding.h"
/*
* Assign bond->master_ipv6 to the next IPv6 address in the list, or
* zero it out if there are none.
*/
static void bond_glean_dev_ipv6(struct net_device *dev, struct in6_addr *addr)
{
struct inet6_dev *idev;
if (!dev)
return;
idev = in6_dev_get(dev);
if (!idev)
return;
read_lock_bh(&idev->lock);
if (!list_empty(&idev->addr_list)) {
struct inet6_ifaddr *ifa
= list_first_entry(&idev->addr_list,
struct inet6_ifaddr, if_list);
ipv6_addr_copy(addr, &ifa->addr);
} else
ipv6_addr_set(addr, 0, 0, 0, 0);
read_unlock_bh(&idev->lock);
in6_dev_put(idev);
}
static void bond_na_send(struct net_device *slave_dev,
struct in6_addr *daddr,
int router,
unsigned short vlan_id)
{
struct in6_addr mcaddr;
struct icmp6hdr icmp6h = {
.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT,
};
struct sk_buff *skb;
icmp6h.icmp6_router = router;
icmp6h.icmp6_solicited = 0;
icmp6h.icmp6_override = 1;
addrconf_addr_solict_mult(daddr, &mcaddr);
pr_debug("ipv6 na on slave %s: dest %pI6, src %pI6\n",
slave_dev->name, &mcaddr, daddr);
skb = ndisc_build_skb(slave_dev, &mcaddr, daddr, &icmp6h, daddr,
ND_OPT_TARGET_LL_ADDR);
if (!skb) {
pr_err("NA packet allocation failed\n");
return;
}
if (vlan_id) {
skb = vlan_put_tag(skb, vlan_id);
if (!skb) {
pr_err("failed to insert VLAN tag\n");
return;
}
}
ndisc_send_skb(skb, slave_dev, NULL, &mcaddr, daddr, &icmp6h);
}
/*
* Kick out an unsolicited Neighbor Advertisement for an IPv6 address on
* the bonding master. This will help the switch learn our address
* if in active-backup mode.
*
* Caller must hold curr_slave_lock for read or better
*/
void bond_send_unsolicited_na(struct bonding *bond)
{
struct slave *slave = bond->curr_active_slave;
struct vlan_entry *vlan;
struct inet6_dev *idev;
int is_router;
pr_debug("%s: bond %s slave %s\n", bond->dev->name,
__func__, slave ? slave->dev->name : "NULL");
if (!slave || !bond->send_unsol_na ||
test_bit(__LINK_STATE_LINKWATCH_PENDING, &slave->dev->state))
return;
bond->send_unsol_na--;
idev = in6_dev_get(bond->dev);
if (!idev)
return;
is_router = !!idev->cnf.forwarding;
in6_dev_put(idev);
if (!ipv6_addr_any(&bond->master_ipv6))
bond_na_send(slave->dev, &bond->master_ipv6, is_router, 0);
list_for_each_entry(vlan, &bond->vlan_list, vlan_list) {
if (!ipv6_addr_any(&vlan->vlan_ipv6)) {
bond_na_send(slave->dev, &vlan->vlan_ipv6, is_router,
vlan->vlan_id);
}
}
}
/*
* bond_inet6addr_event: handle inet6addr notifier chain events.
*
* We keep track of device IPv6 addresses primarily to use as source
* addresses in NS probes.
*
* We track one IPv6 for the main device (if it has one).
*/
static int bond_inet6addr_event(struct notifier_block *this,
unsigned long event,
void *ptr)
{
struct inet6_ifaddr *ifa = ptr;
struct net_device *vlan_dev, *event_dev = ifa->idev->dev;
struct bonding *bond;
struct vlan_entry *vlan;
struct bond_net *bn = net_generic(dev_net(event_dev), bond_net_id);
list_for_each_entry(bond, &bn->dev_list, bond_list) {
if (bond->dev == event_dev) {
switch (event) {
case NETDEV_UP:
if (ipv6_addr_any(&bond->master_ipv6))
ipv6_addr_copy(&bond->master_ipv6,
&ifa->addr);
return NOTIFY_OK;
case NETDEV_DOWN:
if (ipv6_addr_equal(&bond->master_ipv6,
&ifa->addr))
bond_glean_dev_ipv6(bond->dev,
&bond->master_ipv6);
return NOTIFY_OK;
default:
return NOTIFY_DONE;
}
}
list_for_each_entry(vlan, &bond->vlan_list, vlan_list) {
if (!bond->vlgrp)
continue;
vlan_dev = vlan_group_get_device(bond->vlgrp,
vlan->vlan_id);
if (vlan_dev == event_dev) {
switch (event) {
case NETDEV_UP:
if (ipv6_addr_any(&vlan->vlan_ipv6))
ipv6_addr_copy(&vlan->vlan_ipv6,
&ifa->addr);
return NOTIFY_OK;
case NETDEV_DOWN:
if (ipv6_addr_equal(&vlan->vlan_ipv6,
&ifa->addr))
bond_glean_dev_ipv6(vlan_dev,
&vlan->vlan_ipv6);
return NOTIFY_OK;
default:
return NOTIFY_DONE;
}
}
}
}
return NOTIFY_DONE;
}
static struct notifier_block bond_inet6addr_notifier = {
.notifier_call = bond_inet6addr_event,
};
void bond_register_ipv6_notifier(void)
{
register_inet6addr_notifier(&bond_inet6addr_notifier);
}
void bond_unregister_ipv6_notifier(void)
{
unregister_inet6addr_notifier(&bond_inet6addr_notifier);
}