On Mon, Jul 1, 2019 at 9:15 PM Jay Vosburgh <[email protected]> wrote: > > Eric Dumazet <[email protected]> wrote: > > >A bonding master can be up while best_slave is NULL. > > > >[12105.636318] BUG: unable to handle kernel NULL pointer dereference at > >0000000000000000 > >[12105.638204] mlx4_en: eth1: Linkstate event 1 -> 1 > >[12105.648984] IP: bond_select_active_slave+0x125/0x250 > >[12105.653977] PGD 0 P4D 0 > >[12105.656572] Oops: 0000 [#1] SMP PTI > >[12105.660487] gsmi: Log Shutdown Reason 0x03 > >[12105.664620] Modules linked in: kvm_intel loop act_mirred uhaul vfat fat > >stg_standard_ftl stg_megablocks stg_idt stg_hdi stg elephant_dev_num > >stg_idt_eeprom w1_therm wire i2c_mux_pca954x i2c_mux mlx4_i2c i2c_usb > >cdc_acm ehci_pci ehci_hcd i2c_iimc mlx4_en mlx4_ib ib_uverbs ib_core > >mlx4_core [last unloaded: kvm_intel] > >[12105.685686] mlx4_core 0000:03:00.0: dispatching link up event for port 2 > >[12105.685700] mlx4_en: eth2: Linkstate event 2 -> 1 > >[12105.685700] mlx4_en: eth2: Link Up (linkstate) > >[12105.724452] Workqueue: bond0 bond_mii_monitor > >[12105.728854] RIP: 0010:bond_select_active_slave+0x125/0x250 > >[12105.734355] RSP: 0018:ffffaf146a81fd88 EFLAGS: 00010246 > >[12105.739637] RAX: 0000000000000003 RBX: ffff8c62b03c6900 RCX: > >0000000000000000 > >[12105.746838] RDX: 0000000000000000 RSI: ffffaf146a81fd08 RDI: > >ffff8c62b03c6000 > >[12105.754054] RBP: ffffaf146a81fdb8 R08: 0000000000000001 R09: > >ffff8c517d387600 > >[12105.761299] R10: 00000000001075d9 R11: ffffffffaceba92f R12: > >0000000000000000 > >[12105.768553] R13: ffff8c8240ae4800 R14: 0000000000000000 R15: > >0000000000000000 > >[12105.775748] FS: 0000000000000000(0000) GS:ffff8c62bfa40000(0000) > >knlGS:0000000000000000 > >[12105.783892] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > >[12105.789716] CR2: 0000000000000000 CR3: 0000000d0520e001 CR4: > >00000000001626f0 > >[12105.796976] Call Trace: > >[12105.799446] [<ffffffffac31d387>] bond_mii_monitor+0x497/0x6f0 > >[12105.805317] [<ffffffffabd42643>] process_one_work+0x143/0x370 > >[12105.811225] [<ffffffffabd42c7a>] worker_thread+0x4a/0x360 > >[12105.816761] [<ffffffffabd48bc5>] kthread+0x105/0x140 > >[12105.821865] [<ffffffffabd42c30>] ? rescuer_thread+0x380/0x380 > >[12105.827757] [<ffffffffabd48ac0>] ? kthread_associate_blkcg+0xc0/0xc0 > >[12105.834266] [<ffffffffac600241>] ret_from_fork+0x51/0x60 > > > >Fixes: e2a7420df2e0 ("bonding/main: convert to using slave printk macros") > >Signed-off-by: Eric Dumazet <[email protected]> > >Reported-by: John Sperbeck <[email protected]> > >Cc: Jarod Wilson <[email protected]> > >CC: Jay Vosburgh <[email protected]> > >CC: Veaceslav Falico <[email protected]> > >CC: Andy Gospodarek <[email protected]> > >--- > > drivers/net/bonding/bond_main.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > >diff --git a/drivers/net/bonding/bond_main.c > >b/drivers/net/bonding/bond_main.c > >index > >a30595955a37a485b9e045a31969313f8336b668..84168455aded96dfd85b310841dee2a0d917b580 > > 100644 > >--- a/drivers/net/bonding/bond_main.c > >+++ b/drivers/net/bonding/bond_main.c > >@@ -937,7 +937,7 @@ void bond_select_active_slave(struct bonding *bond) > > return; > > > > if (netif_carrier_ok(bond->dev)) > >- slave_info(bond->dev, best_slave->dev, "active > >interface up!\n"); > >+ netdev_info(bond->dev, "active interface up!\n"); > > else > > netdev_info(bond->dev, "now running without any > > active interface!\n"); > > } > > What is the bonding mode and options in the failure case?
I am not sure. Basically I only have crash dumps at this point (no idea how to repro the bug) I guess that is : Bonding Mode: IEEE 802.3ad Dynamic link aggregation Transmit Hash Policy: encap3+4 (4) Use Carrier: 1 MII Status: up MII Polling Interval (ms): 100 Up Delay (ms): 0 Down Delay (ms): 0 MAC address: 00:1a:11:c0:65:40 Active Members: eth1 eth2 > > I see that the fix is fine in the sense that it returns to the > original status quo for the message. > > However, the code path seems odd; if best_slave is NULL, that > means that bond_find_best_slave() saw all slaves as down, but if > netif_carrier_ok is true, then bond_set_carrier() did not.
