Commit b37d428b authored by Pavel Emelyanov's avatar Pavel Emelyanov Committed by David S. Miller
Browse files

[INET]: Don't create tunnels with '%' in name. 



Four tunnel drivers (ip_gre, ipip, ip6_tunnel and sit) can receive a
pre-defined name for a device from the userspace.  Since these drivers
call the register_netdevice() (rtnl_lock, is held), which does _not_
generate the device's name, this name may contain a '%' character.

Not sure how bad is this to have a device with a '%' in its name, but
all the other places either use the register_netdev(), which call the
dev_alloc_name(), or explicitly call the dev_alloc_name() before
registering, i.e. do not allow for such names.

This had to be prior to the commit 34cc7b, but I forgot to number the
patches and this one got lost, sorry.

Signed-off-by: default avatarPavel Emelyanov <xemul@openvz.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent d9595a7b

net/ipv4/ip_gre.c

+9 −5
Original line number Diff line number Diff line
@@ -266,20 +266,24 @@ static struct ip_tunnel * ipgre_tunnel_locate(struct ip_tunnel_parm *parms, int 
	if (!dev)

	  return NULL;



	if (strchr(name, '%')) {

		if (dev_alloc_name(dev, name) < 0)

			goto failed_free;

	}



	dev->init = ipgre_tunnel_init;

	nt = netdev_priv(dev);

	nt->parms = *parms;



	if (register_netdevice(dev) < 0) {

		free_netdev(dev);

		goto failed;

	}

	if (register_netdevice(dev) < 0)

		goto failed_free;



	dev_hold(dev);

	ipgre_tunnel_link(nt);

	return nt;



failed:

failed_free:

	free_netdev(dev);

	return NULL;

}

net/ipv4/ipip.c

+9 −5
Original line number Diff line number Diff line
@@ -228,20 +228,24 @@ static struct ip_tunnel * ipip_tunnel_locate(struct ip_tunnel_parm *parms, int c 
	if (dev == NULL)

		return NULL;



	if (strchr(name, '%')) {

		if (dev_alloc_name(dev, name) < 0)

			goto failed_free;

	}



	nt = netdev_priv(dev);

	dev->init = ipip_tunnel_init;

	nt->parms = *parms;



	if (register_netdevice(dev) < 0) {

		free_netdev(dev);

		goto failed;

	}

	if (register_netdevice(dev) < 0)

		goto failed_free;



	dev_hold(dev);

	ipip_tunnel_link(nt);

	return nt;



failed:

failed_free:

	free_netdev(dev);

	return NULL;

}

net/ipv6/ip6_tunnel.c

+11 −4
Original line number Diff line number Diff line
@@ -238,17 +238,24 @@ static struct ip6_tnl *ip6_tnl_create(struct ip6_tnl_parm *p) 
	if (dev == NULL)

		goto failed;



	if (strchr(name, '%')) {

		if (dev_alloc_name(dev, name) < 0)

			goto failed_free;

	}



	t = netdev_priv(dev);

	dev->init = ip6_tnl_dev_init;

	t->parms = *p;



	if ((err = register_netdevice(dev)) < 0) {

		free_netdev(dev);

		goto failed;

	}

	if ((err = register_netdevice(dev)) < 0)

		goto failed_free;



	dev_hold(dev);

	ip6_tnl_link(t);

	return t;



failed_free:

	free_netdev(dev);

failed:

	return NULL;

}

net/ipv6/sit.c

+9 −4
Original line number Diff line number Diff line
@@ -171,6 +171,11 @@ static struct ip_tunnel * ipip6_tunnel_locate(struct ip_tunnel_parm *parms, int 
	if (dev == NULL)

		return NULL;



	if (strchr(name, '%')) {

		if (dev_alloc_name(dev, name) < 0)

			goto failed_free;

	}



	nt = netdev_priv(dev);

	dev->init = ipip6_tunnel_init;

	nt->parms = *parms;
@@ -178,16 +183,16 @@ static struct ip_tunnel * ipip6_tunnel_locate(struct ip_tunnel_parm *parms, int 
	if (parms->i_flags & SIT_ISATAP)

		dev->priv_flags |= IFF_ISATAP;



	if (register_netdevice(dev) < 0) {

		free_netdev(dev);

		goto failed;

	}

	if (register_netdevice(dev) < 0)

		goto failed_free;



	dev_hold(dev);



	ipip6_tunnel_link(nt);

	return nt;



failed_free:

	free_netdev(dev);

failed:

	return NULL;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE