bonding: fix bond_3ad_set_carrier() RCU usage

Currently, its usage is just plainly wrong. It first gets a slave under
RCU, and, after releasing the RCU lock, continues to use it - whilst it can
be freed.

Fix this by ensuring that bond_3ad_set_carrier() holds RCU till it uses its
slave (or its agg).

Fixes: be79bd048ab ("bonding: add RCU for bond_3ad_state_machine_handler()")
CC: dingtianhong@huawei.com
CC: Jay Vosburgh <fubar@us.ibm.com>
CC: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: Veaceslav Falico <vfalico@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 29db1caee7646a140ed7459947a5f72992a74dcf..da0d7c54d3529b6ae2ada3d61fe3c2e7b3015307 100644 (file)
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2327,32 +2327,32 @@ int bond_3ad_set_carrier(struct bonding *bond)
 {
        struct aggregator *active;
        struct slave *first_slave;
+       int ret = 1;
 
        rcu_read_lock();
        first_slave = bond_first_slave_rcu(bond);
-       rcu_read_unlock();
-       if (!first_slave)
-               return 0;
+       if (!first_slave) {
+               ret = 0;
+               goto out;
+       }
        active = __get_active_agg(&(SLAVE_AD_INFO(first_slave).aggregator));
        if (active) {
                /* are enough slaves available to consider link up? */
                if (active->num_of_ports < bond->params.min_links) {
                        if (netif_carrier_ok(bond->dev)) {
                                netif_carrier_off(bond->dev);
-                               return 1;
+                               goto out;
                        }
                } else if (!netif_carrier_ok(bond->dev)) {
                        netif_carrier_on(bond->dev);
-                       return 1;
+                       goto out;
                }
-               return 0;
-       }
-
-       if (netif_carrier_ok(bond->dev)) {
+       } else if (netif_carrier_ok(bond->dev)) {
                netif_carrier_off(bond->dev);
-               return 1;
        }
-       return 0;
+out:
+       rcu_read_unlock();
+       return ret;
 }
 
 /**