netdev - Re: [PATCH] bonding: fix a race condition in calls to slave MII ioctls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20091028.222501.264905294.davem@davemloft.net>
Date:	Wed, 28 Oct 2009 22:25:01 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	jbohac@...e.cz
Cc:	fubar@...ibm.com, netdev@...r.kernel.org
Subject: Re: [PATCH] bonding: fix a race condition in calls to slave MII
 ioctls

From: Jiri Bohac <jbohac@...e.cz>
Date: Wed, 21 Oct 2009 15:03:01 +0200

> Hi,
> 
> In mii monitor mode, bond_check_dev_link() calls the the ioctl
> handler of slave devices. It stores the ndo_do_ioctl function
> pointer to a static (!) ioctl variable and later uses it to call the
> handler with the IOCTL macro.
> 
> If another thread executes bond_check_dev_link() at the same time
> (even with a different bond, which none of the locks prevent), a
> race condition occurs. If the two racing slaves have different
> drivers, this may result in one driver's ioctl handler being
> called with a pointer to a net_device controlled with a different
> driver, resulting in unpredictable breakage.
> 
> Unless I am overlooking something, the "static" must be a
> copy'n'paste error (?).
> 
> 
> Signed-off-by: Jiri Bohac <jbohac@...e.cz>

Cur and paste... from where?  If you look at the 2.6.14-->2.6.14.1
commit in the history-2.6 tree (5db5272c) this static was there from
the moment the link status checking got added to the bonding driver
in Linus's tree.

Nevertheless indeed it is an awful bug, patch applied, thanks!
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html