summaryrefslogtreecommitdiffstats
path: root/drivers/net/tun.c
diff options
context:
space:
mode:
authorStefan Hajnoczi <stefanha@redhat.com>2013-01-09 22:59:48 +0100
committerDavid S. Miller <davem@davemloft.net>2013-01-10 23:24:10 +0100
commit6e331f4c83021e4de2a2fc4981574b5d5b16c425 (patch)
treecc7e9eed80682c95c8a0446b6d92220703aa8c2a /drivers/net/tun.c
parentipv6: use addrconf_get_prefix_route for prefix route lookup [v2] (diff)
downloadlinux-6e331f4c83021e4de2a2fc4981574b5d5b16c425.tar.xz
linux-6e331f4c83021e4de2a2fc4981574b5d5b16c425.zip
tuntap: refuse to re-attach to different tun_struct
Multiqueue tun devices support detaching a tun_file from its tun_struct and re-attaching at a later point in time. This allows users to disable a specific queue temporarily. ioctl(TUNSETIFF) allows the user to specify the network interface to attach by name. This means the user can attempt to attach to interface "B" after detaching from interface "A". The driver is not designed to support this so check we are re-attaching to the right tun_struct. Failure to do so may lead to oops. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/tun.c')
-rw-r--r--drivers/net/tun.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index fbd106edbe59..cf6da6efc71a 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -491,6 +491,8 @@ static int tun_attach(struct tun_struct *tun, struct file *file)
err = -EINVAL;
if (rcu_dereference_protected(tfile->tun, lockdep_rtnl_is_held()))
goto out;
+ if (tfile->detached && tun != tfile->detached)
+ goto out;
err = -EBUSY;
if (!(tun->flags & TUN_TAP_MQ) && tun->numqueues == 1)