bonding: fix send_peer_notif overflow

Bonding send_peer_notif was defined as u8. Since commit 07a4ddec3ce9
("bonding: add an option to specify a delay between peer notifications").
the bond->send_peer_notif will be num_peer_notif multiplied by
peer_notif_delay, which is u8 * u32. This would cause the send_peer_notif
overflow easily. e.g.

  ip link add bond0 type bond mode 1 miimon 100 num_grat_arp 30 peer_notify_delay 1000

To fix the overflow, let's set the send_peer_notif to u32 and limit
peer_notif_delay to 300s.

Reported-by: Liang Li <liali@redhat.com>
Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2090053
Fixes: 07a4ddec3ce9 ("bonding: add an option to specify a delay between peer notifications")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
index c2d080fc4fc4ea67bd81476c485af69f72c7c4bd..27cbe148f0db5f82e988af3773fff1e3fce0997d 100644 (file)
--- a/drivers/net/bonding/bond_netlink.c
+++ b/drivers/net/bonding/bond_netlink.c
@@ -84,6 +84,11 @@ nla_put_failure:
        return -EMSGSIZE;
 }
 
+/* Limit the max delay range to 300s */
+static struct netlink_range_validation delay_range = {
+       .max = 300000,
+};
+
 static const struct nla_policy bond_policy[IFLA_BOND_MAX + 1] = {
        [IFLA_BOND_MODE]                = { .type = NLA_U8 },
        [IFLA_BOND_ACTIVE_SLAVE]        = { .type = NLA_U32 },
@@ -114,7 +119,7 @@ static const struct nla_policy bond_policy[IFLA_BOND_MAX + 1] = {
        [IFLA_BOND_AD_ACTOR_SYSTEM]     = { .type = NLA_BINARY,
                                            .len  = ETH_ALEN },
        [IFLA_BOND_TLB_DYNAMIC_LB]      = { .type = NLA_U8 },
-       [IFLA_BOND_PEER_NOTIF_DELAY]    = { .type = NLA_U32 },
+       [IFLA_BOND_PEER_NOTIF_DELAY]    = NLA_POLICY_FULL_RANGE(NLA_U32, &delay_range),
        [IFLA_BOND_MISSED_MAX]          = { .type = NLA_U8 },
        [IFLA_BOND_NS_IP6_TARGET]       = { .type = NLA_NESTED },
 };

diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
index 0498fc6731f898f6a238498d42a0f0ade6c67856..f3f27f0bd2a6cdd52d8c97e10a9b047af9f2da00 100644 (file)
--- a/drivers/net/bonding/bond_options.c
+++ b/drivers/net/bonding/bond_options.c
@@ -169,6 +169,12 @@ static const struct bond_opt_value bond_num_peer_notif_tbl[] = {
        { NULL,      -1,  0}
 };
 
+static const struct bond_opt_value bond_peer_notif_delay_tbl[] = {
+       { "off",     0,   0},
+       { "maxval",  300000, BOND_VALFLAG_MAX},
+       { NULL,      -1,  0}
+};
+
 static const struct bond_opt_value bond_primary_reselect_tbl[] = {
        { "always",  BOND_PRI_RESELECT_ALWAYS,  BOND_VALFLAG_DEFAULT},
        { "better",  BOND_PRI_RESELECT_BETTER,  0},
@@ -488,7 +494,7 @@ static const struct bond_option bond_opts[BOND_OPT_LAST] = {
                .id = BOND_OPT_PEER_NOTIF_DELAY,
                .name = "peer_notif_delay",
                .desc = "Delay between each peer notification on failover event, in milliseconds",
-               .values = bond_intmax_tbl,
+               .values = bond_peer_notif_delay_tbl,
                .set = bond_option_peer_notif_delay_set
        }
 };

diff --git a/include/net/bonding.h b/include/net/bonding.h
index a60a24923b559972d72320588fe05de50ca4195e..0efef2a952b79efe3e2c7fee998b9ea63c864747 100644 (file)
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -233,7 +233,7 @@ struct bonding {
         */
        spinlock_t mode_lock;
        spinlock_t stats_lock;
-       u8       send_peer_notif;
+       u32      send_peer_notif;
        u8       igmp_retrans;
 #ifdef CONFIG_PROC_FS
        struct   proc_dir_entry *proc_entry;