diff options
| author | Eric W. Biederman <ebiederm@aristanetworks.com> | 2009-06-08 00:44:31 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2009-06-08 00:44:31 -0700 |
| commit | f0a4d0e5b5bfd271e6737f7c095994835b70d450 (patch) | |
| tree | a3ee9afad29dd6e01d7fe36c45ec1cca8d052ab9 /drivers/net | |
| parent | ef681ce1e8b3e63317cd724c200b2fd39286c005 (diff) | |
tun: Fix unregister race
It is possible for tun_chr_close to race with dellink on the
a tun device. In which case if __tun_get runs before dellink
but dellink runs before tun_chr_close calls unregister_netdevice
we will attempt to unregister the netdevice after it is already
gone.
The two cases are already serialized on the rtnl_lock, so I have
gone for the cheap simple fix of moving rtnl_lock to cover __tun_get
in tun_chr_close. Eliminating the possibility of the tun device
being unregistered between __tun_get and unregister_netdevice in
tun_chr_close.
Signed-off-by: Eric W. Biederman <ebiederm@aristanetworks.com>
Tested-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/tun.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/net/tun.c b/drivers/net/tun.c index d83ccb8c982..811d3517fce 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -1322,21 +1322,22 @@ static int tun_chr_open(struct inode *inode, struct file * file) static int tun_chr_close(struct inode *inode, struct file *file) { struct tun_file *tfile = file->private_data; - struct tun_struct *tun = __tun_get(tfile); + struct tun_struct *tun; + rtnl_lock(); + tun = __tun_get(tfile); if (tun) { DBG(KERN_INFO "%s: tun_chr_close\n", tun->dev->name); - rtnl_lock(); __tun_detach(tun); /* If desireable, unregister the netdevice. */ if (!(tun->flags & TUN_PERSIST)) unregister_netdevice(tun->dev); - rtnl_unlock(); } + rtnl_unlock(); tun = tfile->tun; if (tun) |