tun: Multicast handling in tun_chr_ioctl() needs proper locking.

Since these operations don't go through the normal
device calls, we have to ensure we synchronize with
those paths.

Noticed by Alan Cox.

Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index d8b1ba1..0ce07a3 100644 (file)
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -741,7 +741,12 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
        case SIOCADDMULTI:
                /** Add the specified group to the character device's multicast filter
                 * list. */
+               rtnl_lock();
+               netif_tx_lock_bh(tun->dev);
                add_multi(tun->chr_filter, ifr.ifr_hwaddr.sa_data);
+               netif_tx_unlock_bh(tun->dev);
+               rtnl_unlock();
+
                DBG(KERN_DEBUG "%s: add multi: %s\n",
                    tun->dev->name, print_mac(mac, ifr.ifr_hwaddr.sa_data));
                return 0;
@@ -749,7 +754,12 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
        case SIOCDELMULTI:
                /** Remove the specified group from the character device's multicast
                 * filter list. */
+               rtnl_lock();
+               netif_tx_lock_bh(tun->dev);
                del_multi(tun->chr_filter, ifr.ifr_hwaddr.sa_data);
+               netif_tx_unlock_bh(tun->dev);
+               rtnl_unlock();
+
                DBG(KERN_DEBUG "%s: del multi: %s\n",
                    tun->dev->name, print_mac(mac, ifr.ifr_hwaddr.sa_data));
                return 0;