Commit d23e4365 authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller

tun: Fix device unregister race

It is currently possible for an asynchronous device unregister
to cause the same tun device to be unregistered twice.  This
is because the unregister in tun_chr_close only checks whether
__tun_get(tfile) != NULL.  This however has nothing to do with
whether the device has already been unregistered.  All it tells
you is whether __tun_detach has been called.

This patch fixes this by using the most obvious thing to test
whether the device has been unregistered.

It also moves __tun_detach outside of rtnl_unlock since nothing
that it does requires that lock.
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c001c213
...@@ -1324,20 +1324,22 @@ static int tun_chr_close(struct inode *inode, struct file *file) ...@@ -1324,20 +1324,22 @@ static int tun_chr_close(struct inode *inode, struct file *file)
struct tun_file *tfile = file->private_data; struct tun_file *tfile = file->private_data;
struct tun_struct *tun; struct tun_struct *tun;
rtnl_lock();
tun = __tun_get(tfile); tun = __tun_get(tfile);
if (tun) { if (tun) {
DBG(KERN_INFO "%s: tun_chr_close\n", tun->dev->name); struct net_device *dev = tun->dev;
DBG(KERN_INFO "%s: tun_chr_close\n", dev->name);
__tun_detach(tun); __tun_detach(tun);
/* If desireable, unregister the netdevice. */ /* If desireable, unregister the netdevice. */
if (!(tun->flags & TUN_PERSIST)) if (!(tun->flags & TUN_PERSIST)) {
unregister_netdevice(tun->dev); rtnl_lock();
if (dev->reg_state == NETREG_REGISTERED)
} unregister_netdevice(dev);
rtnl_unlock(); rtnl_unlock();
}
}
tun = tfile->tun; tun = tfile->tun;
if (tun) if (tun)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment