aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEric W. Biederman <ebiederm@aristanetworks.com>2009-06-08 00:44:31 -0700
committerDavid S. Miller <davem@davemloft.net>2009-06-08 00:44:31 -0700
commitf0a4d0e5b5bfd271e6737f7c095994835b70d450 (patch)
treea3ee9afad29dd6e01d7fe36c45ec1cca8d052ab9
parentef681ce1e8b3e63317cd724c200b2fd39286c005 (diff)
tun: Fix unregister race
It is possible for tun_chr_close to race with dellink on the a tun device. In which case if __tun_get runs before dellink but dellink runs before tun_chr_close calls unregister_netdevice we will attempt to unregister the netdevice after it is already gone. The two cases are already serialized on the rtnl_lock, so I have gone for the cheap simple fix of moving rtnl_lock to cover __tun_get in tun_chr_close. Eliminating the possibility of the tun device being unregistered between __tun_get and unregister_netdevice in tun_chr_close. Signed-off-by: Eric W. Biederman <ebiederm@aristanetworks.com> Tested-by: David Woodhouse <David.Woodhouse@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--drivers/net/tun.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index d83ccb8c982..811d3517fce 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1322,21 +1322,22 @@ static int tun_chr_open(struct inode *inode, struct file * file)
static int tun_chr_close(struct inode *inode, struct file *file)
{
struct tun_file *tfile = file->private_data;
- struct tun_struct *tun = __tun_get(tfile);
+ struct tun_struct *tun;
+ rtnl_lock();
+ tun = __tun_get(tfile);
if (tun) {
DBG(KERN_INFO "%s: tun_chr_close\n", tun->dev->name);
- rtnl_lock();
__tun_detach(tun);
/* If desireable, unregister the netdevice. */
if (!(tun->flags & TUN_PERSIST))
unregister_netdevice(tun->dev);
- rtnl_unlock();
}
+ rtnl_unlock();
tun = tfile->tun;
if (tun)