bonding: fix multiple 3ad mode sysfs race conditions
When bond_3ad_get_active_agg_info() is used in all show_ad_ functions
it is not protected against slave manipulation and since it walks over
the slaves and uses them, this can easily result in NULL pointer
dereference or use of freed memory. Both the new wrapper and the
internal function are exported to the bonding as they're needed in
different places.
Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 77ea237..d7434e0 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -1319,7 +1319,6 @@
}
static DEVICE_ATTR(mii_status, S_IRUGO, bonding_show_mii_status, NULL);
-
/*
* Show current 802.3ad aggregator ID.
*/
@@ -1333,7 +1332,7 @@
if (bond->params.mode == BOND_MODE_8023AD) {
struct ad_info ad_info;
count = sprintf(buf, "%d\n",
- (bond_3ad_get_active_agg_info(bond, &ad_info))
+ bond_3ad_get_active_agg_info(bond, &ad_info)
? 0 : ad_info.aggregator_id);
}
@@ -1355,7 +1354,7 @@
if (bond->params.mode == BOND_MODE_8023AD) {
struct ad_info ad_info;
count = sprintf(buf, "%d\n",
- (bond_3ad_get_active_agg_info(bond, &ad_info))
+ bond_3ad_get_active_agg_info(bond, &ad_info)
? 0 : ad_info.ports);
}
@@ -1377,7 +1376,7 @@
if (bond->params.mode == BOND_MODE_8023AD) {
struct ad_info ad_info;
count = sprintf(buf, "%d\n",
- (bond_3ad_get_active_agg_info(bond, &ad_info))
+ bond_3ad_get_active_agg_info(bond, &ad_info)
? 0 : ad_info.actor_key);
}
@@ -1399,7 +1398,7 @@
if (bond->params.mode == BOND_MODE_8023AD) {
struct ad_info ad_info;
count = sprintf(buf, "%d\n",
- (bond_3ad_get_active_agg_info(bond, &ad_info))
+ bond_3ad_get_active_agg_info(bond, &ad_info)
? 0 : ad_info.partner_key);
}