Re: [PATCH 2/2] bonding: fix bonding_masters race condition in bond unloading

[Veaceslav Falico <vfalico@redhat.com>]

On Sat, Apr 06, 2013 at 12:54:38PM +0200, Nikolay Aleksandrov wrote:
>While the bonding module is unloading, it is considered that after
>rtnl_link_unregister all bond devices are destroyed but since no
>synchronization mechanism exists, a new bond device can be created
>via bonding_masters before unregister_pernet_subsys which would
>lead to multiple problems (e.g. NULL pointer dereference, wrong RIP,
>list corruption).
>
>This patch fixes the issue by removing any bond devices left in the
>netns after bonding_masters is removed from sysfs.
>
>Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
>---
> drivers/net/bonding/bond_main.c | 9 +++++++++
> 1 file changed, 9 insertions(+)
>

Given that this bug is in net tree and we really need a fix to continue
development, adding a second device removal loop is not a big deal
actually, and this can be addressed correctly later in net-next. It's a
really rare bug anyway, and the second loop most of the time would be a
simple no-op, as Nikolay correctly stated.

Acked-by: Veaceslav Falico <vfalico@redhat.com>