diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2022-06-23 07:20:39 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-07-07 18:52:16 +0300 |
| commit | bec1be0a745ab420718217e3e0d9542a75108989 (patch) | |
| tree | 83133840854d69526f7a1dcb9b3a11964462b694 | |
| parent | 0b2499c8014fc06733202a2bd36451b96ed7cd2b (diff) | |
| download | linux-bec1be0a745ab420718217e3e0d9542a75108989.tar.xz | |
net: tun: unlink NAPI from device on destruction
commit 3b9bc84d311104906d2b4995a9a02d7b7ddab2db upstream.
Syzbot found a race between tun file and device destruction.
NAPIs live in struct tun_file which can get destroyed before
the netdev so we have to del them explicitly. The current
code is missing deleting the NAPI if the queue was detached
first.
Fixes: 943170998b20 ("tun: enable NAPI for TUN/TAP driver")
Reported-by: syzbot+b75c138e9286ac742647@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20220623042039.2274708-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/net/tun.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 55ce141c93c7..aa8ee7542c3c 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -733,6 +733,7 @@ static void tun_detach_all(struct net_device *dev) sock_put(&tfile->sk); } list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) { + tun_napi_del(tfile); tun_enable_queue(tfile); tun_queue_purge(tfile); xdp_rxq_info_unreg(&tfile->xdp_rxq); |