lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 28 Oct 2009 22:25:01 -0700 (PDT) From: David Miller <davem@...emloft.net> To: jbohac@...e.cz Cc: fubar@...ibm.com, netdev@...r.kernel.org Subject: Re: [PATCH] bonding: fix a race condition in calls to slave MII ioctls From: Jiri Bohac <jbohac@...e.cz> Date: Wed, 21 Oct 2009 15:03:01 +0200 > Hi, > > In mii monitor mode, bond_check_dev_link() calls the the ioctl > handler of slave devices. It stores the ndo_do_ioctl function > pointer to a static (!) ioctl variable and later uses it to call the > handler with the IOCTL macro. > > If another thread executes bond_check_dev_link() at the same time > (even with a different bond, which none of the locks prevent), a > race condition occurs. If the two racing slaves have different > drivers, this may result in one driver's ioctl handler being > called with a pointer to a net_device controlled with a different > driver, resulting in unpredictable breakage. > > Unless I am overlooking something, the "static" must be a > copy'n'paste error (?). > > > Signed-off-by: Jiri Bohac <jbohac@...e.cz> Cur and paste... from where? If you look at the 2.6.14-->2.6.14.1 commit in the history-2.6 tree (5db5272c) this static was there from the moment the link status checking got added to the bonding driver in Linus's tree. Nevertheless indeed it is an awful bug, patch applied, thanks! -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists