From: Flavio Leitner <fleitner@redhat.com>
Date: Wed, 4 Aug 2010 22:51:33 -0400
Subject: [net] bonding: fix a race in calls to slave MII ioctls
Message-id: <20100804225133.GC3230@redhat.com>
Patchwork-id: 27398
O-Subject: [RHEL5.7 PATCH] bonding: fix a race condition in calls to slave MII
	ioctls
Bugzilla: 621280
RH-Acked-by: David S. Miller <davem@redhat.com>
RH-Acked-by: Amerigo Wang <amwang@redhat.com>
RH-Acked-by: Jiri Pirko <jpirko@redhat.com>

RHBZ#: 621280
=======
https://bugzilla.redhat.com/show_bug.cgi?id=621280

Description:
=============
Although the customer had found the problem on RHEL4,
the same fix applies for RHEL5.

Upstream:
==========
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=patch;h=d9d52832

    From d9d5283228d0c752f199c901fff6e1405dc91bcb Mon Sep 17 00:00:00 2001
    From: Jiri Bohac <jbohac@suse.cz>
    Date: Wed, 28 Oct 2009 22:23:54 -0700
    Subject: [PATCH] bonding: fix a race condition in calls to slave MII
    ioctls

    In mii monitor mode, bond_check_dev_link() calls the the ioctl
    handler of slave devices. It stores the ndo_do_ioctl function
    pointer to a static (!) ioctl variable and later uses it to call the
    handler with the IOCTL macro.

    If another thread executes bond_check_dev_link() at the same time
    (even with a different bond, which none of the locks prevent), a
    race condition occurs. If the two racing slaves have different
    drivers, this may result in one driver's ioctl handler being
    called with a pointer to a net_device controlled with a different
    driver, resulting in unpredictable breakage.

    Unless I am overlooking something, the "static" must be a
    copy'n'paste error (?).

    Signed-off-by: Jiri Bohac <jbohac@suse.cz>
    Signed-off-by: David S. Miller <davem@davemloft.net>

Test Build at:
===============
Brew build url:
https://brewweb.devel.redhat.com/taskinfo?taskID=2653754

Testing Status:
===============
I could not reproduce it locally, but the fix is trivial and applied
upstream long time ago.

Proposed Patch:
================
It's a simple backport of the upstream commit mentioned above.

Signed-off-by: Flavio Leitner <fbl@redhat.com>
Signed-off-by: Jarod Wilson <jarod@redhat.com>

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 0ec122e..586c464 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -723,7 +723,7 @@ verify:
  */
 static int bond_check_dev_link(struct bonding *bond, struct net_device *slave_dev, int reporting)
 {
-	static int (* ioctl)(struct net_device *, struct ifreq *, int);
+	int (* ioctl)(struct net_device *, struct ifreq *, int);
 	struct ifreq ifr;
 	struct mii_ioctl_data *mii;
 	struct ethtool_value etool;