| Message ID | 20220623042039.2274708-1-kuba@kernel.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 3b9bc84d311104906d2b4995a9a02d7b7ddab2db |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] net: tun: unlink NAPI from device on destruction | expand |
Hello: This patch was applied to netdev/net.git (master) by Jakub Kicinski <kuba@kernel.org>: On Wed, 22 Jun 2022 21:20:39 -0700 you wrote: > Syzbot found a race between tun file and device destruction. > NAPIs live in struct tun_file which can get destroyed before > the netdev so we have to del them explicitly. The current > code is missing deleting the NAPI if the queue was detached > first. > > Fixes: 943170998b20 ("tun: enable NAPI for TUN/TAP driver") > Reported-by: syzbot+b75c138e9286ac742647@syzkaller.appspotmail.com > Signed-off-by: Jakub Kicinski <kuba@kernel.org> > > [...] Here is the summary with links: - [net] net: tun: unlink NAPI from device on destruction https://git.kernel.org/netdev/net/c/3b9bc84d3111 You are awesome, thank you!
diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 87a635aac008..7fd0288c3789 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -727,6 +727,7 @@ static void tun_detach_all(struct net_device *dev) sock_put(&tfile->sk); } list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) { + tun_napi_del(tfile); tun_enable_queue(tfile); tun_queue_purge(tfile); xdp_rxq_info_unreg(&tfile->xdp_rxq);
Syzbot found a race between tun file and device destruction. NAPIs live in struct tun_file which can get destroyed before the netdev so we have to del them explicitly. The current code is missing deleting the NAPI if the queue was detached first. Fixes: 943170998b20 ("tun: enable NAPI for TUN/TAP driver") Reported-by: syzbot+b75c138e9286ac742647@syzkaller.appspotmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> --- CC: peterpenkov96@gmail.com CC: maheshb@google.com --- drivers/net/tun.c | 1 + 1 file changed, 1 insertion(+)