ip_tunnel: Don't allow to add the same tunnel multiple times.

[ Upstream commit d61746b2e71bf612fb397b00242de5df5ba7f29a ]

When we try to add an already existing tunnel, we don't return
an error. Instead we continue and call ip_tunnel_update().
This means that we can change existing tunnels by adding
the same tunnel multiple times. It is even possible to change
the tunnel endpoints of the fallback device.

We fix this by returning an error if we try to add an existing
tunnel.

Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 45920d928341576ea243a67b78cf7abe5b1d5537..6c2719373bc5168fcc5f606f58aadce48ecf0d4e 100644 (file)
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -764,9 +764,14 @@ int ip_tunnel_ioctl(struct net_device *dev, struct ip_tunnel_parm *p, int cmd)
 
                t = ip_tunnel_find(itn, p, itn->fb_tunnel_dev->type);
 
-               if (!t && (cmd == SIOCADDTUNNEL)) {
-                       t = ip_tunnel_create(net, itn, p);
-                       err = PTR_ERR_OR_ZERO(t);
+               if (cmd == SIOCADDTUNNEL) {
+                       if (!t) {
+                               t = ip_tunnel_create(net, itn, p);
+                               err = PTR_ERR_OR_ZERO(t);
+                               break;
+                       }
+
+                       err = -EEXIST;
                        break;
                }
                if (dev != itn->fb_tunnel_dev && cmd == SIOCCHGTUNNEL) {