Commit 48abfe05 authored by David S. Miller's avatar David S. Miller
Browse files

tun: Fix minor race in TUNSETLINK ioctl handling. 



Noticed by Alan Cox.

The IFF_UP test is a bit racey, because other entities
outside of this driver's ioctl handler can modify that
state, even though this ioctl handler runs under
lock_kernel().

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8c0469cd

drivers/net/tun.c

+9 −2
Original line number Diff line number Diff line
@@ -668,16 +668,23 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file, 
		break;



	case TUNSETLINK:

	{

		int ret;



		/* Only allow setting the type when the interface is down */

		rtnl_lock();

		if (tun->dev->flags & IFF_UP) {

			DBG(KERN_INFO "%s: Linktype set failed because interface is up\n",

				tun->dev->name);

			return -EBUSY;

			ret = -EBUSY;

		} else {

			tun->dev->type = (int) arg;

			DBG(KERN_INFO "%s: linktype set to %d\n", tun->dev->name, tun->dev->type);

			ret = 0;

		}

		rtnl_unlock();

		return ret;

	}

		break;



#ifdef TUN_DEBUG

	case TUNSETDEBUG: