Subject: Re: [PATCH net-2.6] bonding: fix a race in IGMP handling

From: David Miller <[email-masked]>
Date: Thu, 18 Nov 2010 09:31:19 -0800 (PST)

From: Eric Dumazet <[email-masked]>
Date: Thu, 18 Nov 2010 11:26:18 +0100

> Actually this raises an interesting case for bonding as well.
> 
> Before my RCU conversion __bond_resend_igmp_join_requests() was unsafe.
> 
> For net-next-2.6, it is now safe (RCU is held), but needs a cleanup
> patch to avoid sparse errors.
> 
> Thanks
> 
> [PATCH net-2.6] bonding: fix a race in IGMP handling
> 
> RCU conversion in IGMP code done in net-next-2.6 raised a race in
> __bond_resend_igmp_join_requests().
> 
> It iterates in_dev->mc_list without appropriate protection (RTNL, or
> read_lock on in_dev->mc_list_lock).
> 
> Another cpu might delete an entry while we use it and trigger a fault.
> 
> Signed-off-by: Eric Dumazet <[email-masked]>
> Cc: Jay Vosburgh <[email-masked]>

Applied, but I'm going to have to be careful and make sure I undo
this the next time I pull net-2.6 into net-next-2.6

Thanks.