summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJiri Bohac <jbohac@suse.cz>2009-10-28 22:23:54 -0700
committerGreg Kroah-Hartman <gregkh@suse.de>2009-11-09 16:22:58 -0800
commit44791e49b282eb1901b28d27d9756ace8f873dca (patch)
tree6dee8d20e2821c8d8019dc9b364b6289e60df09c
parent474ac4951f31a678cda82833c6ec6dbb4b58bacb (diff)
downloadlwn-44791e49b282eb1901b28d27d9756ace8f873dca.tar.gz
lwn-44791e49b282eb1901b28d27d9756ace8f873dca.zip
bonding: fix a race condition in calls to slave MII ioctls
commit d9d5283228d0c752f199c901fff6e1405dc91bcb upstream. In mii monitor mode, bond_check_dev_link() calls the the ioctl handler of slave devices. It stores the ndo_do_ioctl function pointer to a static (!) ioctl variable and later uses it to call the handler with the IOCTL macro. If another thread executes bond_check_dev_link() at the same time (even with a different bond, which none of the locks prevent), a race condition occurs. If the two racing slaves have different drivers, this may result in one driver's ioctl handler being called with a pointer to a net_device controlled with a different driver, resulting in unpredictable breakage. Unless I am overlooking something, the "static" must be a copy'n'paste error (?). Signed-off-by: Jiri Bohac <jbohac@suse.cz> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r--drivers/net/bonding/bond_main.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index aa1be1feceed..7029d5396757 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -691,7 +691,7 @@ static int bond_check_dev_link(struct bonding *bond,
struct net_device *slave_dev, int reporting)
{
const struct net_device_ops *slave_ops = slave_dev->netdev_ops;
- static int (*ioctl)(struct net_device *, struct ifreq *, int);
+ int (*ioctl)(struct net_device *, struct ifreq *, int);
struct ifreq ifr;
struct mii_ioctl_data *mii;