提交 f0a4d0e5 编写于 作者: E Eric W. Biederman 提交者: David S. Miller

tun: Fix unregister race

It is possible for tun_chr_close to race with dellink on the
a tun device.  In which case if __tun_get runs before dellink
but dellink runs before tun_chr_close calls unregister_netdevice
we will attempt to unregister the netdevice after it is already
gone.  

The two cases are already serialized on the rtnl_lock, so I have
gone for the cheap simple fix of moving rtnl_lock to cover __tun_get
in tun_chr_close.  Eliminating the possibility of the tun device
being unregistered between __tun_get and unregister_netdevice in
tun_chr_close.
Signed-off-by: NEric W. Biederman <ebiederm@aristanetworks.com>
Tested-by: NDavid Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 ef681ce1
......@@ -1322,21 +1322,22 @@ static int tun_chr_open(struct inode *inode, struct file * file)
static int tun_chr_close(struct inode *inode, struct file *file)
{
struct tun_file *tfile = file->private_data;
struct tun_struct *tun = __tun_get(tfile);
struct tun_struct *tun;
rtnl_lock();
tun = __tun_get(tfile);
if (tun) {
DBG(KERN_INFO "%s: tun_chr_close\n", tun->dev->name);
rtnl_lock();
__tun_detach(tun);
/* If desireable, unregister the netdevice. */
if (!(tun->flags & TUN_PERSIST))
unregister_netdevice(tun->dev);
rtnl_unlock();
}
rtnl_unlock();
tun = tfile->tun;
if (tun)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册