From: Julien Gomes <julien@arista.com>
Date: Wed, 25 Oct 2017 18:50:50 +0000 (-0700)
Subject: tun: allow positive return values on dev_get_valid_name() call
X-Git-Tag: v3.18.82~7
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0e14c46808100ab64d3c935de776afb0ed7f0550;p=thirdparty%2Fkernel%2Fstable.git

tun: allow positive return values on dev_get_valid_name() call


[ Upstream commit 5c25f65fd1e42685f7ccd80e0621829c105785d9 ]

If the name argument of dev_get_valid_name() contains "%d", it will try
to assign it a unit number in __dev__alloc_name() and return either the
unit number (>= 0) or an error code (< 0).
Considering positive values as error values prevent tun device creations
relying this mechanism, therefor we should only consider negative values
as errors here.

Signed-off-by: Julien Gomes <julien@arista.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index cd6b6d3fd4e2c..3067f840210e5 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1657,7 +1657,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 		if (!dev)
 			return -ENOMEM;
 		err = dev_get_valid_name(net, dev, name);
-		if (err)
+		if (err < 0)
 			goto err_free_dev;
 
 		dev_net_set(dev, net);