1 files changed, 7 insertions, 4 deletions

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index a4fdad475594..18656c4094b3 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -856,10 +856,6 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
                 err = 0;
         }
 
-        rcu_assign_pointer(tfile->tun, tun);
-        rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
-        tun->numqueues++;
-
         if (tfile->detached) {
                 tun_enable_queue(tfile);
         } else {
@@ -876,6 +872,13 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
          * refcnt.
          */
 
+        /* Publish tfile->tun and tun->tfiles only after we've fully
+         * initialized tfile; otherwise we risk using half-initialized
+         * object.
+         */
+        rcu_assign_pointer(tfile->tun, tun);
+        rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
+        tun->numqueues++;
 out:
         return err;
 }