diff options
| author | Jiri Bohac <jbohac@suse.cz> | 2009-10-28 22:23:54 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2009-11-09 16:52:45 -0800 |
| commit | 3d364e6533516b915af98317cd555ecd85073503 (patch) | |
| tree | f6c16bee9e424c651907918f0771e17e59a9ce20 | |
| parent | 71e2f32b6006fcef62578fb5bb7ba025a85a2d44 (diff) | |
bonding: fix a race condition in calls to slave MII ioctls
commit d9d5283228d0c752f199c901fff6e1405dc91bcb upstream.
In mii monitor mode, bond_check_dev_link() calls the the ioctl
handler of slave devices. It stores the ndo_do_ioctl function
pointer to a static (!) ioctl variable and later uses it to call the
handler with the IOCTL macro.
If another thread executes bond_check_dev_link() at the same time
(even with a different bond, which none of the locks prevent), a
race condition occurs. If the two racing slaves have different
drivers, this may result in one driver's ioctl handler being
called with a pointer to a net_device controlled with a different
driver, resulting in unpredictable breakage.
Unless I am overlooking something, the "static" must be a
copy'n'paste error (?).
Signed-off-by: Jiri Bohac <jbohac@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/net/bonding/bond_main.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index f9f29c91d4f..5a07b5039e6 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -686,7 +686,7 @@ static int bond_update_speed_duplex(struct slave *slave) */ static int bond_check_dev_link(struct bonding *bond, struct net_device *slave_dev, int reporting) { - static int (* ioctl)(struct net_device *, struct ifreq *, int); + int (* ioctl)(struct net_device *, struct ifreq *, int); struct ifreq ifr; struct mii_ioctl_data *mii; |