Skip to content

Commit c4f050c

Browse files
edumazetkuba-moo
edumazet
authored and
kuba-moo
committed
bonding: 3ad: implement proper RCU rules for port->aggregator
syzbot found a data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler [1] which hints at lack of proper RCU implementation. Add __rcu qualifier to port->aggregator, and add proper RCU API. [1] BUG: KCSAN: data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler write to 0xffff88813cf5c4b0 of 8 bytes by task 36 on cpu 0: ad_port_selection_logic drivers/net/bonding/bond_3ad.c:1659 [inline] bond_3ad_state_machine_handler+0x9d5/0x2d60 drivers/net/bonding/bond_3ad.c:2569 process_one_work kernel/workqueue.c:3302 [inline] process_scheduled_works+0x4f0/0x9c0 kernel/workqueue.c:3385 worker_thread+0x58a/0x780 kernel/workqueue.c:3466 kthread+0x22a/0x280 kernel/kthread.c:436 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 read to 0xffff88813cf5c4b0 of 8 bytes by task 22063 on cpu 1: __bond_3ad_get_active_agg_info drivers/net/bonding/bond_3ad.c:2858 [inline] bond_3ad_get_active_agg_info+0x8c/0x230 drivers/net/bonding/bond_3ad.c:2881 bond_fill_info+0xe0f/0x10f0 drivers/net/bonding/bond_netlink.c:853 rtnl_link_info_fill net/core/rtnetlink.c:906 [inline] rtnl_link_fill+0x1d7/0x4e0 net/core/rtnetlink.c:927 rtnl_fill_ifinfo+0xf8e/0x1380 net/core/rtnetlink.c:2168 rtmsg_ifinfo_build_skb+0x11c/0x1b0 net/core/rtnetlink.c:4453 rtmsg_ifinfo_event net/core/rtnetlink.c:4486 [inline] rtmsg_ifinfo+0x6d/0x110 net/core/rtnetlink.c:4495 __dev_notify_flags+0x76/0x390 net/core/dev.c:9790 netif_change_flags+0xac/0xd0 net/core/dev.c:9823 do_setlink+0x905/0x2950 net/core/rtnetlink.c:3180 rtnl_group_changelink net/core/rtnetlink.c:3813 [inline] __rtnl_newlink net/core/rtnetlink.c:3981 [inline] rtnl_newlink+0xf55/0x1400 net/core/rtnetlink.c:4109 rtnetlink_rcv_msg+0x64b/0x720 net/core/rtnetlink.c:6995 netlink_rcv_skb+0x123/0x220 net/netlink/af_netlink.c:2550 rtnetlink_rcv+0x1c/0x30 net/core/rtnetlink.c:7022 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x5a8/0x680 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x5c8/0x6f0 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:787 [inline] __sock_sendmsg net/socket.c:802 [inline] ____sys_sendmsg+0x563/0x5b0 net/socket.c:2698 ___sys_sendmsg+0x195/0x1e0 net/socket.c:2752 __sys_sendmsg net/socket.c:2784 [inline] __do_sys_sendmsg net/socket.c:2789 [inline] __se_sys_sendmsg net/socket.c:2787 [inline] __x64_sys_sendmsg+0xd4/0x160 net/socket.c:2787 x64_sys_call+0x194c/0x3020 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x0000000000000000 -> 0xffff88813cf5c400 Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 22063 Comm: syz.0.31122 Tainted: G W syzkaller #0 PREEMPT(full) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Fixes: 47e91f5 ("bonding: use RCU protection for 3ad xmit path") Reported-by: syzbot+9bb2ff2a4ab9e17307e1@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/69f0a82f.050a0220.3aadc4.0000.GAE@google.com/ Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Jay Vosburgh <jv@jvosburgh.net> Cc: Andrew Lunn <andrew+netdev@lunn.ch> Link: https://patch.msgid.link/20260428123207.3809211-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
1 parent 4ca0129 commit c4f050c

6 files changed

Lines changed: 89 additions & 66 deletions

File tree

‎drivers/net/bonding/bond_3ad.c‎

Lines changed: 60 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -1029,13 +1029,15 @@ static void ad_cond_set_peer_notif(struct port *port)
10291029
static void ad_mux_machine(struct port *port, bool *update_slave_arr)
10301030
{
10311031
struct bonding *bond = __get_bond_by_port(port);
1032+
struct aggregator *aggregator;
10321033
mux_states_t last_state;
10331034

10341035
/* keep current State Machine state to compare later if it was
10351036
* changed
10361037
*/
10371038
last_state = port->sm_mux_state;
10381039

1040+
aggregator = rcu_dereference(port->aggregator);
10391041
if (port->sm_vars & AD_PORT_BEGIN) {
10401042
port->sm_mux_state = AD_MUX_DETACHED;
10411043
} else {
@@ -1055,7 +1057,7 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr)
10551057
* cycle to update ready variable, we check
10561058
* READY_N and update READY here
10571059
*/
1058-
__set_agg_ports_ready(port->aggregator, __agg_ports_are_ready(port->aggregator));
1060+
__set_agg_ports_ready(aggregator, __agg_ports_are_ready(aggregator));
10591061
port->sm_mux_state = AD_MUX_DETACHED;
10601062
break;
10611063
}
@@ -1070,7 +1072,7 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr)
10701072
* update ready variable, we check READY_N and update
10711073
* READY here
10721074
*/
1073-
__set_agg_ports_ready(port->aggregator, __agg_ports_are_ready(port->aggregator));
1075+
__set_agg_ports_ready(aggregator, __agg_ports_are_ready(aggregator));
10741076

10751077
/* if the wait_while_timer expired, and the port is
10761078
* in READY state, move to ATTACHED state
@@ -1086,7 +1088,7 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr)
10861088
if ((port->sm_vars & AD_PORT_SELECTED) &&
10871089
(port->partner_oper.port_state & LACP_STATE_SYNCHRONIZATION) &&
10881090
!__check_agg_selection_timer(port)) {
1089-
if (port->aggregator->is_active) {
1091+
if (aggregator->is_active) {
10901092
int state = AD_MUX_COLLECTING_DISTRIBUTING;
10911093

10921094
if (!bond->params.coupled_control)
@@ -1102,9 +1104,9 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr)
11021104
* cycle to update ready variable, we check
11031105
* READY_N and update READY here
11041106
*/
1105-
__set_agg_ports_ready(port->aggregator, __agg_ports_are_ready(port->aggregator));
1107+
__set_agg_ports_ready(aggregator, __agg_ports_are_ready(aggregator));
11061108
port->sm_mux_state = AD_MUX_DETACHED;
1107-
} else if (port->aggregator->is_active) {
1109+
} else if (aggregator->is_active) {
11081110
port->actor_oper_port_state |=
11091111
LACP_STATE_SYNCHRONIZATION;
11101112
}
@@ -1115,7 +1117,7 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr)
11151117
* sure that a collecting distributing
11161118
* port in an active aggregator is enabled
11171119
*/
1118-
if (port->aggregator->is_active &&
1120+
if (aggregator->is_active &&
11191121
!__port_is_collecting_distributing(port)) {
11201122
__enable_port(port);
11211123
*update_slave_arr = true;
@@ -1134,7 +1136,7 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr)
11341136
*/
11351137
struct slave *slave = port->slave;
11361138

1137-
if (port->aggregator->is_active &&
1139+
if (aggregator->is_active &&
11381140
bond_is_slave_rx_disabled(slave)) {
11391141
ad_enable_collecting(port);
11401142
*update_slave_arr = true;
@@ -1154,8 +1156,8 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr)
11541156
* sure that a collecting distributing
11551157
* port in an active aggregator is enabled
11561158
*/
1157-
if (port->aggregator &&
1158-
port->aggregator->is_active &&
1159+
if (aggregator &&
1160+
aggregator->is_active &&
11591161
!__port_is_collecting_distributing(port)) {
11601162
__enable_port(port);
11611163
*update_slave_arr = true;
@@ -1187,7 +1189,7 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr)
11871189
port->sm_mux_timer_counter = __ad_timer_to_ticks(AD_WAIT_WHILE_TIMER, 0);
11881190
break;
11891191
case AD_MUX_ATTACHED:
1190-
if (port->aggregator->is_active)
1192+
if (aggregator->is_active)
11911193
port->actor_oper_port_state |=
11921194
LACP_STATE_SYNCHRONIZATION;
11931195
else
@@ -1561,9 +1563,9 @@ static void ad_port_selection_logic(struct port *port, bool *update_slave_arr)
15611563
bond = __get_bond_by_port(port);
15621564

15631565
/* if the port is connected to other aggregator, detach it */
1564-
if (port->aggregator) {
1566+
temp_aggregator = rcu_dereference(port->aggregator);
1567+
if (temp_aggregator) {
15651568
/* detach the port from its former aggregator */
1566-
temp_aggregator = port->aggregator;
15671569
for (curr_port = temp_aggregator->lag_ports; curr_port;
15681570
last_port = curr_port,
15691571
curr_port = curr_port->next_port_in_aggregator) {
@@ -1586,7 +1588,7 @@ static void ad_port_selection_logic(struct port *port, bool *update_slave_arr)
15861588
/* clear the port's relations to this
15871589
* aggregator
15881590
*/
1589-
port->aggregator = NULL;
1591+
RCU_INIT_POINTER(port->aggregator, NULL);
15901592
port->next_port_in_aggregator = NULL;
15911593
port->actor_port_aggregator_identifier = 0;
15921594

@@ -1609,7 +1611,7 @@ static void ad_port_selection_logic(struct port *port, bool *update_slave_arr)
16091611
port->slave->bond->dev->name,
16101612
port->slave->dev->name,
16111613
port->actor_port_number,
1612-
port->aggregator->aggregator_identifier);
1614+
temp_aggregator->aggregator_identifier);
16131615
}
16141616
}
16151617
/* search on all aggregators for a suitable aggregator for this port */
@@ -1633,15 +1635,15 @@ static void ad_port_selection_logic(struct port *port, bool *update_slave_arr)
16331635
)
16341636
) {
16351637
/* attach to the founded aggregator */
1636-
port->aggregator = aggregator;
1638+
rcu_assign_pointer(port->aggregator, aggregator);
16371639
port->actor_port_aggregator_identifier =
1638-
port->aggregator->aggregator_identifier;
1640+
aggregator->aggregator_identifier;
16391641
port->next_port_in_aggregator = aggregator->lag_ports;
1640-
port->aggregator->num_of_ports++;
1642+
aggregator->num_of_ports++;
16411643
aggregator->lag_ports = port;
16421644
slave_dbg(bond->dev, slave->dev, "Port %d joined LAG %d (existing LAG)\n",
16431645
port->actor_port_number,
1644-
port->aggregator->aggregator_identifier);
1646+
aggregator->aggregator_identifier);
16451647

16461648
/* mark this port as selected */
16471649
port->sm_vars |= AD_PORT_SELECTED;
@@ -1656,39 +1658,40 @@ static void ad_port_selection_logic(struct port *port, bool *update_slave_arr)
16561658
if (!found) {
16571659
if (free_aggregator) {
16581660
/* assign port a new aggregator */
1659-
port->aggregator = free_aggregator;
16601661
port->actor_port_aggregator_identifier =
1661-
port->aggregator->aggregator_identifier;
1662+
free_aggregator->aggregator_identifier;
16621663

16631664
/* update the new aggregator's parameters
16641665
* if port was responsed from the end-user
16651666
*/
16661667
if (port->actor_oper_port_key & AD_DUPLEX_KEY_MASKS)
16671668
/* if port is full duplex */
1668-
port->aggregator->is_individual = false;
1669+
free_aggregator->is_individual = false;
16691670
else
1670-
port->aggregator->is_individual = true;
1671+
free_aggregator->is_individual = true;
16711672

1672-
port->aggregator->actor_admin_aggregator_key =
1673+
free_aggregator->actor_admin_aggregator_key =
16731674
port->actor_admin_port_key;
1674-
port->aggregator->actor_oper_aggregator_key =
1675+
free_aggregator->actor_oper_aggregator_key =
16751676
port->actor_oper_port_key;
1676-
port->aggregator->partner_system =
1677+
free_aggregator->partner_system =
16771678
port->partner_oper.system;
1678-
port->aggregator->partner_system_priority =
1679+
free_aggregator->partner_system_priority =
16791680
port->partner_oper.system_priority;
1680-
port->aggregator->partner_oper_aggregator_key = port->partner_oper.key;
1681-
port->aggregator->receive_state = 1;
1682-
port->aggregator->transmit_state = 1;
1683-
port->aggregator->lag_ports = port;
1684-
port->aggregator->num_of_ports++;
1681+
free_aggregator->partner_oper_aggregator_key = port->partner_oper.key;
1682+
free_aggregator->receive_state = 1;
1683+
free_aggregator->transmit_state = 1;
1684+
free_aggregator->lag_ports = port;
1685+
free_aggregator->num_of_ports++;
1686+
1687+
rcu_assign_pointer(port->aggregator, free_aggregator);
16851688

16861689
/* mark this port as selected */
16871690
port->sm_vars |= AD_PORT_SELECTED;
16881691

16891692
slave_dbg(bond->dev, port->slave->dev, "Port %d joined LAG %d (new LAG)\n",
16901693
port->actor_port_number,
1691-
port->aggregator->aggregator_identifier);
1694+
free_aggregator->aggregator_identifier);
16921695
} else {
16931696
slave_err(bond->dev, port->slave->dev,
16941697
"Port %d did not find a suitable aggregator\n",
@@ -1700,13 +1703,12 @@ static void ad_port_selection_logic(struct port *port, bool *update_slave_arr)
17001703
* in all aggregator's ports, else set ready=FALSE in all
17011704
* aggregator's ports
17021705
*/
1703-
__set_agg_ports_ready(port->aggregator,
1704-
__agg_ports_are_ready(port->aggregator));
1706+
aggregator = rcu_dereference(port->aggregator);
1707+
__set_agg_ports_ready(aggregator, __agg_ports_are_ready(aggregator));
17051708

1706-
aggregator = __get_first_agg(port);
1707-
ad_agg_selection_logic(aggregator, update_slave_arr);
1709+
ad_agg_selection_logic(__get_first_agg(port), update_slave_arr);
17081710

1709-
if (!port->aggregator->is_active)
1711+
if (!aggregator->is_active)
17101712
port->actor_oper_port_state &= ~LACP_STATE_SYNCHRONIZATION;
17111713
}
17121714

@@ -2075,13 +2077,15 @@ static void ad_initialize_port(struct port *port, const struct bond_params *bond
20752077
*/
20762078
static void ad_enable_collecting(struct port *port)
20772079
{
2078-
if (port->aggregator->is_active) {
2080+
struct aggregator *aggregator = rcu_dereference(port->aggregator);
2081+
2082+
if (aggregator->is_active) {
20792083
struct slave *slave = port->slave;
20802084

20812085
slave_dbg(slave->bond->dev, slave->dev,
20822086
"Enabling collecting on port %d (LAG %d)\n",
20832087
port->actor_port_number,
2084-
port->aggregator->aggregator_identifier);
2088+
aggregator->aggregator_identifier);
20852089
__enable_collecting_port(port);
20862090
}
20872091
}
@@ -2093,11 +2097,13 @@ static void ad_enable_collecting(struct port *port)
20932097
*/
20942098
static void ad_disable_distributing(struct port *port, bool *update_slave_arr)
20952099
{
2096-
if (port->aggregator && __agg_has_partner(port->aggregator)) {
2100+
struct aggregator *aggregator = rcu_dereference(port->aggregator);
2101+
2102+
if (aggregator && __agg_has_partner(aggregator)) {
20972103
slave_dbg(port->slave->bond->dev, port->slave->dev,
20982104
"Disabling distributing on port %d (LAG %d)\n",
20992105
port->actor_port_number,
2100-
port->aggregator->aggregator_identifier);
2106+
aggregator->aggregator_identifier);
21012107
__disable_distributing_port(port);
21022108
/* Slave array needs an update */
21032109
*update_slave_arr = true;
@@ -2114,11 +2120,13 @@ static void ad_disable_distributing(struct port *port, bool *update_slave_arr)
21142120
static void ad_enable_collecting_distributing(struct port *port,
21152121
bool *update_slave_arr)
21162122
{
2117-
if (port->aggregator->is_active) {
2123+
struct aggregator *aggregator = rcu_dereference(port->aggregator);
2124+
2125+
if (aggregator->is_active) {
21182126
slave_dbg(port->slave->bond->dev, port->slave->dev,
21192127
"Enabling port %d (LAG %d)\n",
21202128
port->actor_port_number,
2121-
port->aggregator->aggregator_identifier);
2129+
aggregator->aggregator_identifier);
21222130
__enable_port(port);
21232131
/* Slave array needs update */
21242132
*update_slave_arr = true;
@@ -2135,11 +2143,13 @@ static void ad_enable_collecting_distributing(struct port *port,
21352143
static void ad_disable_collecting_distributing(struct port *port,
21362144
bool *update_slave_arr)
21372145
{
2138-
if (port->aggregator && __agg_has_partner(port->aggregator)) {
2146+
struct aggregator *aggregator = rcu_dereference(port->aggregator);
2147+
2148+
if (aggregator && __agg_has_partner(aggregator)) {
21392149
slave_dbg(port->slave->bond->dev, port->slave->dev,
21402150
"Disabling port %d (LAG %d)\n",
21412151
port->actor_port_number,
2142-
port->aggregator->aggregator_identifier);
2152+
aggregator->aggregator_identifier);
21432153
__disable_port(port);
21442154
/* Slave array needs an update */
21452155
*update_slave_arr = true;
@@ -2379,7 +2389,7 @@ void bond_3ad_unbind_slave(struct slave *slave)
23792389
*/
23802390
for (temp_port = aggregator->lag_ports; temp_port;
23812391
temp_port = temp_port->next_port_in_aggregator) {
2382-
temp_port->aggregator = new_aggregator;
2392+
rcu_assign_pointer(temp_port->aggregator, new_aggregator);
23832393
temp_port->actor_port_aggregator_identifier = new_aggregator->aggregator_identifier;
23842394
}
23852395

@@ -2848,15 +2858,16 @@ int bond_3ad_set_carrier(struct bonding *bond)
28482858
int __bond_3ad_get_active_agg_info(struct bonding *bond,
28492859
struct ad_info *ad_info)
28502860
{
2851-
struct aggregator *aggregator = NULL;
2861+
struct aggregator *aggregator = NULL, *tmp;
28522862
struct list_head *iter;
28532863
struct slave *slave;
28542864
struct port *port;
28552865

28562866
bond_for_each_slave_rcu(bond, slave, iter) {
28572867
port = &(SLAVE_AD_INFO(slave)->port);
2858-
if (port->aggregator && port->aggregator->is_active) {
2859-
aggregator = port->aggregator;
2868+
tmp = rcu_dereference(port->aggregator);
2869+
if (tmp && tmp->is_active) {
2870+
aggregator = tmp;
28602871
break;
28612872
}
28622873
}

‎drivers/net/bonding/bond_main.c‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1433,7 +1433,7 @@ static void bond_poll_controller(struct net_device *bond_dev)
14331433

14341434
if (BOND_MODE(bond) == BOND_MODE_8023AD) {
14351435
struct aggregator *agg =
1436-
SLAVE_AD_INFO(slave)->port.aggregator;
1436+
rcu_dereference(SLAVE_AD_INFO(slave)->port.aggregator);
14371437

14381438
if (agg &&
14391439
agg->aggregator_identifier != ad_info.aggregator_id)
@@ -5179,15 +5179,16 @@ int bond_update_slave_arr(struct bonding *bond, struct slave *skipslave)
51795179
spin_unlock_bh(&bond->mode_lock);
51805180
agg_id = ad_info.aggregator_id;
51815181
}
5182+
rcu_read_lock();
51825183
bond_for_each_slave(bond, slave, iter) {
51835184
if (skipslave == slave)
51845185
continue;
51855186

51865187
all_slaves->arr[all_slaves->count++] = slave;
51875188
if (BOND_MODE(bond) == BOND_MODE_8023AD) {
5188-
struct aggregator *agg;
5189+
const struct aggregator *agg;
51895190

5190-
agg = SLAVE_AD_INFO(slave)->port.aggregator;
5191+
agg = rcu_dereference(SLAVE_AD_INFO(slave)->port.aggregator);
51915192
if (!agg || agg->aggregator_identifier != agg_id)
51925193
continue;
51935194
}
@@ -5199,6 +5200,7 @@ int bond_update_slave_arr(struct bonding *bond, struct slave *skipslave)
51995200

52005201
usable_slaves->arr[usable_slaves->count++] = slave;
52015202
}
5203+
rcu_read_unlock();
52025204

52035205
bond_set_slave_arr(bond, usable_slaves, all_slaves);
52045206
return ret;

‎drivers/net/bonding/bond_netlink.c‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -66,27 +66,29 @@ static int bond_fill_slave_info(struct sk_buff *skb,
6666
const struct port *ad_port;
6767

6868
ad_port = &SLAVE_AD_INFO(slave)->port;
69-
agg = SLAVE_AD_INFO(slave)->port.aggregator;
69+
rcu_read_lock();
70+
agg = rcu_dereference(SLAVE_AD_INFO(slave)->port.aggregator);
7071
if (agg) {
7172
if (nla_put_u16(skb, IFLA_BOND_SLAVE_AD_AGGREGATOR_ID,
7273
agg->aggregator_identifier))
73-
goto nla_put_failure;
74+
goto nla_put_failure_rcu;
7475
if (nla_put_u8(skb,
7576
IFLA_BOND_SLAVE_AD_ACTOR_OPER_PORT_STATE,
7677
ad_port->actor_oper_port_state))
77-
goto nla_put_failure;
78+
goto nla_put_failure_rcu;
7879
if (nla_put_u16(skb,
7980
IFLA_BOND_SLAVE_AD_PARTNER_OPER_PORT_STATE,
8081
ad_port->partner_oper.port_state))
81-
goto nla_put_failure;
82+
goto nla_put_failure_rcu;
8283

8384
if (nla_put_u8(skb, IFLA_BOND_SLAVE_AD_CHURN_ACTOR_STATE,
8485
ad_port->sm_churn_actor_state))
85-
goto nla_put_failure;
86+
goto nla_put_failure_rcu;
8687
if (nla_put_u8(skb, IFLA_BOND_SLAVE_AD_CHURN_PARTNER_STATE,
8788
ad_port->sm_churn_partner_state))
88-
goto nla_put_failure;
89+
goto nla_put_failure_rcu;
8990
}
91+
rcu_read_unlock();
9092

9193
if (nla_put_u16(skb, IFLA_BOND_SLAVE_ACTOR_PORT_PRIO,
9294
SLAVE_AD_INFO(slave)->port_priority))
@@ -95,6 +97,8 @@ static int bond_fill_slave_info(struct sk_buff *skb,
9597

9698
return 0;
9799

100+
nla_put_failure_rcu:
101+
rcu_read_unlock();
98102
nla_put_failure:
99103
return -EMSGSIZE;
100104
}

0 commit comments

Comments
 (0)