net: tun: unlink NAPI from device on destruction

kuba-moo · kuba-moo · commit 3b9bc84d3111 · 2022-06-24T16:28:08.000-07:00
Syzbot found a race between tun file and device destruction. NAPIs live in struct tun_file which can get destroyed before the netdev so we have to del them explicitly. The current code is missing deleting the NAPI if the queue was detached first. Fixes: 9431709 ("tun: enable NAPI for TUN/TAP driver") Reported-by: syzbot+b75c138e9286ac742647@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20220623042039.2274708-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
@@ -727,6 +727,7 @@ static void tun_detach_all(struct net_device *dev)
 		sock_put(&tfile->sk);
 	}
 	list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) {
+		tun_napi_del(tfile);
 		tun_enable_queue(tfile);
 		tun_queue_purge(tfile);
 		xdp_rxq_info_unreg(&tfile->xdp_rxq);

Original file line number	Diff line number	Diff line change
`@@ -727,6 +727,7 @@ static void tun_detach_all(struct net_device *dev)`
`727`	`727`	`sock_put(&tfile->sk);`
`728`	`728`	`}`
`729`	`729`	`list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) {`
	`730`	`+ tun_napi_del(tfile);`
`730`	`731`	`tun_enable_queue(tfile);`
`731`	`732`	`tun_queue_purge(tfile);`
`732`	`733`	`xdp_rxq_info_unreg(&tfile->xdp_rxq);`