Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 69b0216a authored by nikolay@redhat.com's avatar nikolay@redhat.com Committed by David S. Miller
Browse files

bonding: fix bonding_masters race condition in bond unloading 



While the bonding module is unloading, it is considered that after
rtnl_link_unregister all bond devices are destroyed but since no
synchronization mechanism exists, a new bond device can be created
via bonding_masters before unregister_pernet_subsys which would
lead to multiple problems (e.g. NULL pointer dereference, wrong RIP,
list corruption).

This patch fixes the issue by removing any bond devices left in the
netns after bonding_masters is removed from sysfs.

Signed-off-by: default avatarNikolay Aleksandrov <nikolay@redhat.com>
Acked-by: default avatarVeaceslav Falico <vfalico@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent ffcdedb6

drivers/net/bonding/bond_main.c

+9 −0
Original line number Original line Diff line number Diff line
@@ -4846,9 +4846,18 @@ static int __net_init bond_net_init(struct net *net) 
static void __net_exit bond_net_exit(struct net *net)

static void __net_exit bond_net_exit(struct net *net)

{

{

	struct bond_net *bn = net_generic(net, bond_net_id);

	struct bond_net *bn = net_generic(net, bond_net_id);

	struct bonding *bond, *tmp_bond;

	LIST_HEAD(list);





	bond_destroy_sysfs(bn);

	bond_destroy_sysfs(bn);

	bond_destroy_proc_dir(bn);

	bond_destroy_proc_dir(bn);



	/* Kill off any bonds created after unregistering bond rtnl ops */

	rtnl_lock();

	list_for_each_entry_safe(bond, tmp_bond, &bn->dev_list, bond_list)

		unregister_netdevice_queue(bond->dev, &list);

	unregister_netdevice_many(&list);

	rtnl_unlock();

}

}





static struct pernet_operations bond_net_ops = {

static struct pernet_operations bond_net_ops = {