linux-stable/drivers/net/bonding
Jiri Bohac d9d5283228 bonding: fix a race condition in calls to slave MII ioctls
In mii monitor mode, bond_check_dev_link() calls the the ioctl
handler of slave devices. It stores the ndo_do_ioctl function
pointer to a static (!) ioctl variable and later uses it to call the
handler with the IOCTL macro.

If another thread executes bond_check_dev_link() at the same time
(even with a different bond, which none of the locks prevent), a
race condition occurs. If the two racing slaves have different
drivers, this may result in one driver's ioctl handler being
called with a pointer to a net_device controlled with a different
driver, resulting in unpredictable breakage.

Unless I am overlooking something, the "static" must be a
copy'n'paste error (?).

Signed-off-by: Jiri Bohac <jbohac@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
2009-10-28 22:23:54 -07:00
..
bond_3ad.c trivial: fix typo "to to" in multiple files 2009-09-21 15:14:55 +02:00
bond_3ad.h Remove duplicate slow protocol define in bond_3ad.h 2009-05-09 13:15:49 -07:00
bond_alb.c bonding: use compare_ether_addr_64bits() in ALB 2009-09-01 17:40:26 -07:00
bond_alb.h Convert bonding timers to workqueues 2007-10-23 20:32:00 -04:00
bond_ipv6.c bonding: wipe out printk's 2009-08-13 16:43:32 -07:00
bond_main.c bonding: fix a race condition in calls to slave MII ioctls 2009-10-28 22:23:54 -07:00
bond_sysfs.c bonding: set primary param via sysfs 2009-10-01 14:34:29 -07:00
bonding.h bonding: use compare_ether_addr_64bits() in ALB 2009-09-01 17:40:26 -07:00
Makefile bonding: send IPv6 neighbor advertisement on failover 2008-11-06 00:49:37 -05:00