race in net/ipv4/ipip.c ?

[Lennert Buytenhek <buytenh@xxxxxxxxxxxxxx>]

Hi!

        static void ipip_tunnel_link(struct ipip_tunnel *t)
        {
                struct ipip_tunnel **tp = ipip_bucket(t);

                t->next = *tp;
                write_lock_bh(&ipip_lock);
                *tp = t;
                write_unlock_bh(&ipip_lock);
        }

Shouldn't the "t->next = *tp" be done inside the write lock?

A similar race exists in ipip_tunnel_unlink, and ip_gre seems to have
the same issues.


cheers,
Lennert