[Xenial - 16.04 ]Bonding driver - stack corruption when trying to copy 20 bytes to a sockaddr
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
linux (Ubuntu) |
Fix Released
|
High
|
Joseph Salisbury | ||
Trusty |
Fix Released
|
High
|
Joseph Salisbury | ||
Xenial |
Fix Released
|
High
|
Joseph Salisbury |
Bug Description
In Ubuntu Xenial with kernel 4.4.0-65, we get kernel Panic after scenario [1].
patch [2] should fix the issue
When using an IPoIB bond currently only active-backup mode is a valid
use case and this commit strengthens it.
Since commit 2ab82852a270 ("net/bonding: Enable bonding to enslave
netdevices not supporting set_mac_address()") was introduced till
4.7-rc1, IPoIB didn't support the set_mac_address ndo, and hence the
fail over mac policy always applied to IPoIB bonds.
With the introduction of commit 492a7e67ff83 ("IB/IPoIB: Allow setting
the device address"), that doesn't hold and practically IPoIB bonds are
broken as of that. To fix it, lets go to fail over mac if the device
doesn't support the ndo OR this is IPoIB device.
As a by-product, this commit also prevents a stack corruption which
occurred when trying to copy 20 bytes (IPoIB) device address
to a sockaddr struct that has only 16 bytes of storage.
[1]
Get panic after create bond with down/updelay and restart NIC driver
Configure bond with down/updelay
cat /etc/network/
auto bond1
iface bond1 inet static
address 31.136.42.17
netmask 255.255.0.0
bond-slaves ib0 ib1
bond-miimon 100
bond-updelay 5000
bond-mode active-backup
bond-primary ib1
bond-downdelay 5000
auto ib0
iface ib0 inet manual
bond-master bond1
auto ib1
iface ib1 inet manual
bond-master bond1
modprobe -r <Ipoib-nic-driver>
[2]
1533e77315220dc
net/bonding: Enforce active-backup policy for IPoIB bonds
Changed in linux (Ubuntu): | |
importance: | Undecided → High |
tags: | added: kernel-da-key |
Changed in linux (Ubuntu): | |
status: | Incomplete → In Progress |
Changed in linux (Ubuntu Xenial): | |
status: | New → In Progress |
importance: | Undecided → High |
Changed in linux (Ubuntu): | |
assignee: | nobody → Joseph Salisbury (jsalisbury) |
Changed in linux (Ubuntu Xenial): | |
assignee: | nobody → Joseph Salisbury (jsalisbury) |
Changed in linux (Ubuntu Trusty): | |
status: | New → In Progress |
importance: | Undecided → High |
assignee: | nobody → Joseph Salisbury (jsalisbury) |
tags: | added: trusty |
Changed in linux (Ubuntu Xenial): | |
status: | In Progress → Fix Committed |
Changed in linux (Ubuntu Trusty): | |
status: | In Progress → Fix Committed |
Changed in linux (Ubuntu): | |
status: | In Progress → Fix Committed |
Changed in linux (Ubuntu): | |
status: | Fix Committed → Fix Released |
This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:
apport-collect 1668042
and then change the status of the bug to 'Confirmed'.
If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.
This change has been made by an automated script, maintained by the Ubuntu Kernel Team.