diff options
author | Jiri Bohac <jbohac@suse.cz> | 2009-10-29 01:23:54 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2009-10-29 01:23:54 -0400 |
commit | d9d5283228d0c752f199c901fff6e1405dc91bcb (patch) | |
tree | a21bf48e33cff976c50ef4f77dcc012cdcac4871 /drivers/net | |
parent | 03f191bab77c0148e458dbbd0a37241be2a2faf9 (diff) |
bonding: fix a race condition in calls to slave MII ioctls
In mii monitor mode, bond_check_dev_link() calls the the ioctl
handler of slave devices. It stores the ndo_do_ioctl function
pointer to a static (!) ioctl variable and later uses it to call the
handler with the IOCTL macro.
If another thread executes bond_check_dev_link() at the same time
(even with a different bond, which none of the locks prevent), a
race condition occurs. If the two racing slaves have different
drivers, this may result in one driver's ioctl handler being
called with a pointer to a net_device controlled with a different
driver, resulting in unpredictable breakage.
Unless I am overlooking something, the "static" must be a
copy'n'paste error (?).
Signed-off-by: Jiri Bohac <jbohac@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net')
-rw-r--r-- | drivers/net/bonding/bond_main.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index 3f05267b2cfd..40fb5eefc72e 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c | |||
@@ -691,7 +691,7 @@ static int bond_check_dev_link(struct bonding *bond, | |||
691 | struct net_device *slave_dev, int reporting) | 691 | struct net_device *slave_dev, int reporting) |
692 | { | 692 | { |
693 | const struct net_device_ops *slave_ops = slave_dev->netdev_ops; | 693 | const struct net_device_ops *slave_ops = slave_dev->netdev_ops; |
694 | static int (*ioctl)(struct net_device *, struct ifreq *, int); | 694 | int (*ioctl)(struct net_device *, struct ifreq *, int); |
695 | struct ifreq ifr; | 695 | struct ifreq ifr; |
696 | struct mii_ioctl_data *mii; | 696 | struct mii_ioctl_data *mii; |
697 | 697 | ||