| From 1d0ca04f861a39a45e1dd3e5533aa88a0aff4d8d Mon Sep 17 00:00:00 2001 |
| From: "nikolay@redhat.com" <nikolay@redhat.com> |
| Date: Sat, 6 Apr 2013 00:54:38 +0000 |
| Subject: bonding: fix bonding_masters race condition in bond unloading |
| |
| |
| From: "nikolay@redhat.com" <nikolay@redhat.com> |
| |
| [ Upstream commit 69b0216ac255f523556fa3d4ff030d857eaaa37f ] |
| |
| While the bonding module is unloading, it is considered that after |
| rtnl_link_unregister all bond devices are destroyed but since no |
| synchronization mechanism exists, a new bond device can be created |
| via bonding_masters before unregister_pernet_subsys which would |
| lead to multiple problems (e.g. NULL pointer dereference, wrong RIP, |
| list corruption). |
| |
| This patch fixes the issue by removing any bond devices left in the |
| netns after bonding_masters is removed from sysfs. |
| |
| Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com> |
| Acked-by: Veaceslav Falico <vfalico@redhat.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/bonding/bond_main.c | 9 +++++++++ |
| 1 file changed, 9 insertions(+) |
| |
| --- a/drivers/net/bonding/bond_main.c |
| +++ b/drivers/net/bonding/bond_main.c |
| @@ -4864,9 +4864,18 @@ static int __net_init bond_net_init(stru |
| static void __net_exit bond_net_exit(struct net *net) |
| { |
| struct bond_net *bn = net_generic(net, bond_net_id); |
| + struct bonding *bond, *tmp_bond; |
| + LIST_HEAD(list); |
| |
| bond_destroy_sysfs(bn); |
| bond_destroy_proc_dir(bn); |
| + |
| + /* Kill off any bonds created after unregistering bond rtnl ops */ |
| + rtnl_lock(); |
| + list_for_each_entry_safe(bond, tmp_bond, &bn->dev_list, bond_list) |
| + unregister_netdevice_queue(bond->dev, &list); |
| + unregister_netdevice_many(&list); |
| + rtnl_unlock(); |
| } |
| |
| static struct pernet_operations bond_net_ops = { |
