From: Jiri Bohac Date: Thu, 29 Oct 2009 05:23:54 +0000 (-0700) Subject: bonding: fix a race condition in calls to slave MII ioctls X-Git-Tag: v2.6.27.39~3 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3d364e6533516b915af98317cd555ecd85073503;p=thirdparty%2Fkernel%2Fstable.git bonding: fix a race condition in calls to slave MII ioctls commit d9d5283228d0c752f199c901fff6e1405dc91bcb upstream. In mii monitor mode, bond_check_dev_link() calls the the ioctl handler of slave devices. It stores the ndo_do_ioctl function pointer to a static (!) ioctl variable and later uses it to call the handler with the IOCTL macro. If another thread executes bond_check_dev_link() at the same time (even with a different bond, which none of the locks prevent), a race condition occurs. If the two racing slaves have different drivers, this may result in one driver's ioctl handler being called with a pointer to a net_device controlled with a different driver, resulting in unpredictable breakage. Unless I am overlooking something, the "static" must be a copy'n'paste error (?). Signed-off-by: Jiri Bohac Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index f9f29c91d4fa9..5a07b5039e6b3 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -686,7 +686,7 @@ static int bond_update_speed_duplex(struct slave *slave) */ static int bond_check_dev_link(struct bonding *bond, struct net_device *slave_dev, int reporting) { - static int (* ioctl)(struct net_device *, struct ifreq *, int); + int (* ioctl)(struct net_device *, struct ifreq *, int); struct ifreq ifr; struct mii_ioctl_data *mii;