lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date:	Mon, 12 Nov 2007 18:26:26 +0200
From:	Moni Shoua <>
To:	Jay Vosburgh <>, Jeff Garzik <>
CC:	Moni Levy <>, Or Gerlitz <>,
Subject: Possible bug in bonding 


As reported last week by Or Gerlitz and confirmed by me, there is a kernel crash 
when trying to unenslave all ib slaves (which leads to bonding master destruction).
I also found that it happens with Ethernet slaves if following the steps:

1. unenslaving all slaves via sysfs
2. deleting the bonding master via sysfs

I see that in commit 6603a6f25e4bca922a7dfbf0bf03072d98850176 
the order of the bonding master destruction sequence was changed 
in 2 places (a part of the commitdiff is below).

Although I might be missing something it looks like a bug to me
to dereference the dev pointer after unregistering it. Am I right?

I also see that the kernel crash doesn't happen when reverting from this 
(part of) the patch.

I'd like to have your opinion please.



commit 6603a6f25e4bca922a7dfbf0bf03072d98850176
Author: Jay Vosburgh <>
Date:   Wed Oct 17 17:37:50 2007 -0700

    bonding: Convert more locks to _bh, acquire rtnl, for new locking
    	Convert more lock acquisitions to _bh flavor to avoid deadlock
    with workqueue activity and add acquisition of RTNL in appropriate places.
    Affects ALB mode, as well as core bonding functions and sysfs.
    Signed-off-by: Andy Gospodarek <>
    Signed-off-by: Jay Vosburgh <>
    Signed-off-by: Jeff Garzik <>

--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1846,9 +1846,9 @@ int bond_release(struct net_device *bond
 void bond_destroy(struct bonding *bond)
+	unregister_netdevice(bond->dev);
-	unregister_netdevice(bond->dev);


@@ -4473,8 +4473,8 @@ static void bond_free_all(void)
 		/* Release the bonded slaves */
-		bond_deinit(bond_dev);
+		bond_deinit(bond_dev);

To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to
More majordomo info at

Powered by blists - more mailing lists