Commit 9949e2ef authored by Hangbin Liu's avatar Hangbin Liu Committed by David S. Miller
Browse files

bonding: fix send_peer_notif overflow 



Bonding send_peer_notif was defined as u8. Since commit 07a4ddec
("bonding: add an option to specify a delay between peer notifications").
the bond->send_peer_notif will be num_peer_notif multiplied by
peer_notif_delay, which is u8 * u32. This would cause the send_peer_notif
overflow easily. e.g.

  ip link add bond0 type bond mode 1 miimon 100 num_grat_arp 30 peer_notify_delay 1000

To fix the overflow, let's set the send_peer_notif to u32 and limit
peer_notif_delay to 300s.

Reported-by: default avatarLiang Li <liali@redhat.com>
Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2090053


Fixes: 07a4ddec ("bonding: add an option to specify a delay between peer notifications")
Signed-off-by: default avatarHangbin Liu <liuhangbin@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7c83e28f

drivers/net/bonding/bond_netlink.c

+6 −1
Original line number Diff line number Diff line
@@ -84,6 +84,11 @@ static int bond_fill_slave_info(struct sk_buff *skb, 
	return -EMSGSIZE;

}



/* Limit the max delay range to 300s */

static struct netlink_range_validation delay_range = {

	.max = 300000,

};



static const struct nla_policy bond_policy[IFLA_BOND_MAX + 1] = {

	[IFLA_BOND_MODE]		= { .type = NLA_U8 },

	[IFLA_BOND_ACTIVE_SLAVE]	= { .type = NLA_U32 },
@@ -114,7 +119,7 @@ static const struct nla_policy bond_policy[IFLA_BOND_MAX + 1] = { 
	[IFLA_BOND_AD_ACTOR_SYSTEM]	= { .type = NLA_BINARY,

					    .len  = ETH_ALEN },

	[IFLA_BOND_TLB_DYNAMIC_LB]	= { .type = NLA_U8 },

	[IFLA_BOND_PEER_NOTIF_DELAY]    = { .type = NLA_U32 },

	[IFLA_BOND_PEER_NOTIF_DELAY]    = NLA_POLICY_FULL_RANGE(NLA_U32, &delay_range),

	[IFLA_BOND_MISSED_MAX]		= { .type = NLA_U8 },

	[IFLA_BOND_NS_IP6_TARGET]	= { .type = NLA_NESTED },

};

drivers/net/bonding/bond_options.c

+7 −1
Original line number Diff line number Diff line
@@ -169,6 +169,12 @@ static const struct bond_opt_value bond_num_peer_notif_tbl[] = { 
	{ NULL,      -1,  0}

};



static const struct bond_opt_value bond_peer_notif_delay_tbl[] = {

	{ "off",     0,   0},

	{ "maxval",  300000, BOND_VALFLAG_MAX},

	{ NULL,      -1,  0}

};



static const struct bond_opt_value bond_primary_reselect_tbl[] = {

	{ "always",  BOND_PRI_RESELECT_ALWAYS,  BOND_VALFLAG_DEFAULT},

	{ "better",  BOND_PRI_RESELECT_BETTER,  0},
@@ -488,7 +494,7 @@ static const struct bond_option bond_opts[BOND_OPT_LAST] = { 
		.id = BOND_OPT_PEER_NOTIF_DELAY,

		.name = "peer_notif_delay",

		.desc = "Delay between each peer notification on failover event, in milliseconds",

		.values = bond_intmax_tbl,

		.values = bond_peer_notif_delay_tbl,

		.set = bond_option_peer_notif_delay_set

	}

};

include/net/bonding.h

+1 −1
Original line number Diff line number Diff line
@@ -233,7 +233,7 @@ struct bonding { 
	 */

	spinlock_t mode_lock;

	spinlock_t stats_lock;

	u8	 send_peer_notif;

	u32	 send_peer_notif;

	u8       igmp_retrans;

#ifdef CONFIG_PROC_FS

	struct   proc_dir_entry *proc_entry;