• Herbert Xu's avatar
    tun: Extend RTNL lock coverage over whole ioctl · 876bfd4d
    Herbert Xu authored
    As it is, parts of the ioctl runs under the RTNL and parts of
    it do not.  The unlocked section is still protected by the BKL,
    but there can be subtle races.  For example, Eric Biederman and
    Paul Moore observed that if two threads tried to create two tun
    devices on the same file descriptor, then unexpected results
    may occur.
    
    As there isn't anything in the ioctl that is expected to sleep
    indefinitely, we can prevent this from occurring by extending
    the RTNL lock coverage.
    
    This also allows to get rid of the BKL.
    
    Finally, I changed tun_get_iff to take a tun device in order to
    avoid calling tun_put which would dead-lock as it also tries to
    take the RTNL lock.
    Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    876bfd4d
tun.c 32.8 KB