tun: Multicast handling in tun_chr_ioctl() needs proper locking.
Since these operations don't go through the normal
device calls, we have to ensure we synchronize with
those paths.
Noticed by Alan Cox.
Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index d8b1ba1..0ce07a3 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -741,7 +741,12 @@
case SIOCADDMULTI:
/** Add the specified group to the character device's multicast filter
* list. */
+ rtnl_lock();
+ netif_tx_lock_bh(tun->dev);
add_multi(tun->chr_filter, ifr.ifr_hwaddr.sa_data);
+ netif_tx_unlock_bh(tun->dev);
+ rtnl_unlock();
+
DBG(KERN_DEBUG "%s: add multi: %s\n",
tun->dev->name, print_mac(mac, ifr.ifr_hwaddr.sa_data));
return 0;
@@ -749,7 +754,12 @@
case SIOCDELMULTI:
/** Remove the specified group from the character device's multicast
* filter list. */
+ rtnl_lock();
+ netif_tx_lock_bh(tun->dev);
del_multi(tun->chr_filter, ifr.ifr_hwaddr.sa_data);
+ netif_tx_unlock_bh(tun->dev);
+ rtnl_unlock();
+
DBG(KERN_DEBUG "%s: del multi: %s\n",
tun->dev->name, print_mac(mac, ifr.ifr_hwaddr.sa_data));
return 0;