tun: Fix minor race in TUNSETLINK ioctl handling.

[safe/jmp/linux-2.6] / drivers / net / tun.c

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index f359d60..d8b1ba1 100644 (file)
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -62,6 +62,7 @@
 #include <linux/if_ether.h>
 #include <linux/if_tun.h>
 #include <linux/crc32.h>
+#include <linux/nsproxy.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 
@@ -112,7 +113,6 @@ struct tun_net {
        struct list_head dev_list;
 };
 
-static LIST_HEAD(tun_dev_list);
 static const struct ethtool_ops tun_ethtool_ops;
 
 /* Net device open. */
@@ -477,14 +477,15 @@ static void tun_setup(struct net_device *dev)
        dev->stop = tun_net_close;
        dev->ethtool_ops = &tun_ethtool_ops;
        dev->destructor = free_netdev;
+       dev->features |= NETIF_F_NETNS_LOCAL;
 }
 
-static struct tun_struct *tun_get_by_name(const char *name)
+static struct tun_struct *tun_get_by_name(struct tun_net *tn, const char *name)
 {
        struct tun_struct *tun;
 
        ASSERT_RTNL();
-       list_for_each_entry(tun, &tun_dev_list, list) {
+       list_for_each_entry(tun, &tn->dev_list, list) {
                if (!strncmp(tun->dev->name, name, IFNAMSIZ))
                    return tun;
        }
@@ -492,13 +493,15 @@ static struct tun_struct *tun_get_by_name(const char *name)
        return NULL;
 }
 
-static int tun_set_iff(struct file *file, struct ifreq *ifr)
+static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 {
+       struct tun_net *tn;
        struct tun_struct *tun;
        struct net_device *dev;
        int err;
 
-       tun = tun_get_by_name(ifr->ifr_name);
+       tn = net_generic(net, tun_net_id);
+       tun = tun_get_by_name(tn, ifr->ifr_name);
        if (tun) {
                if (tun->attached)
                        return -EBUSY;
@@ -511,7 +514,7 @@ static int tun_set_iff(struct file *file, struct ifreq *ifr)
                     !capable(CAP_NET_ADMIN))
                        return -EPERM;
        }
-       else if (__dev_get_by_name(&init_net, ifr->ifr_name))
+       else if (__dev_get_by_name(net, ifr->ifr_name))
                return -EINVAL;
        else {
                char *name;
@@ -542,6 +545,7 @@ static int tun_set_iff(struct file *file, struct ifreq *ifr)
                if (!dev)
                        return -ENOMEM;
 
+               dev_net_set(dev, net);
                tun = netdev_priv(dev);
                tun->dev = dev;
                tun->flags = flags;
@@ -564,7 +568,7 @@ static int tun_set_iff(struct file *file, struct ifreq *ifr)
                if (err < 0)
                        goto err_free_dev;
 
-               list_add(&tun->list, &tun_dev_list);
+               list_add(&tun->list, &tn->dev_list);
        }
 
        DBG(KERN_INFO "%s: tun_set_iff\n", tun->dev->name);
@@ -581,6 +585,7 @@ static int tun_set_iff(struct file *file, struct ifreq *ifr)
 
        file->private_data = tun;
        tun->attached = 1;
+       get_net(dev_net(tun->dev));
 
        strcpy(ifr->ifr_name, tun->dev->name);
        return 0;
@@ -609,7 +614,7 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                ifr.ifr_name[IFNAMSIZ-1] = '\0';
 
                rtnl_lock();
-               err = tun_set_iff(file, &ifr);
+               err = tun_set_iff(current->nsproxy->net_ns, file, &ifr);
                rtnl_unlock();
 
                if (err)
@@ -663,16 +668,23 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                break;
 
        case TUNSETLINK:
+       {
+               int ret;
+
                /* Only allow setting the type when the interface is down */
+               rtnl_lock();
                if (tun->dev->flags & IFF_UP) {
                        DBG(KERN_INFO "%s: Linktype set failed because interface is up\n",
                                tun->dev->name);
-                       return -EBUSY;
+                       ret = -EBUSY;
                } else {
                        tun->dev->type = (int) arg;
                        DBG(KERN_INFO "%s: linktype set to %d\n", tun->dev->name, tun->dev->type);
+                       ret = 0;
                }
-               break;
+               rtnl_unlock();
+               return ret;
+       }
 
 #ifdef TUN_DEBUG
        case TUNSETDEBUG:
@@ -796,6 +808,7 @@ static int tun_chr_close(struct inode *inode, struct file *file)
        /* Detach from net device */
        file->private_data = NULL;
        tun->attached = 0;
+       put_net(dev_net(tun->dev));
 
        /* Drop read queue */
        skb_queue_purge(&tun->readq);
@@ -936,8 +949,17 @@ static int tun_init_net(struct net *net)
 static void tun_exit_net(struct net *net)
 {
        struct tun_net *tn;
+       struct tun_struct *tun, *nxt;
 
        tn = net_generic(net, tun_net_id);
+
+       rtnl_lock();
+       list_for_each_entry_safe(tun, nxt, &tn->dev_list, list) {
+               DBG(KERN_INFO "%s cleaned up\n", tun->dev->name);
+               unregister_netdevice(tun->dev);
+       }
+       rtnl_unlock();
+
        kfree(tn);
 }
 
@@ -974,17 +996,7 @@ err_pernet:
 
 static void tun_cleanup(void)
 {
-       struct tun_struct *tun, *nxt;
-
        misc_deregister(&tun_miscdev);
-
-       rtnl_lock();
-       list_for_each_entry_safe(tun, nxt, &tun_dev_list, list) {
-               DBG(KERN_INFO "%s cleaned up\n", tun->dev->name);
-               unregister_netdevice(tun->dev);
-       }
-       rtnl_unlock();
-
        unregister_pernet_gen_device(tun_net_id, &tun_net_ops);
 }