[PATCH net] tun: drop batched packets while the device is down

[PATCH net] tun: drop batched packets while the device is down

[Xiao Liang]

tun_sendmsg() handles TUN_MSG_PTR batches from vhost-net by calling
tun_xdp_one() instead of tun_get_user(). But this path does not check
IFF_UP, allowing packets from a guest to be injected into the host
receive path while the device is administratively down.

Check IFF_UP in tun_xdp_one() before running XDP or building an skb.
Drop the packet when the device is down, matching tun_get_user().

Fixes: 043d222f93ab ("tuntap: accept an array of XDP buffs through sendmsg()")
Signed-off-by: Xiao Liang <shaw.leon@gmail.com>
---
 drivers/net/tun.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 439565a264ee..2cb0de36e186 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -2551,6 +2551,12 @@ static int tun_xdp_one(struct tun_struct *tun,
 		return -EINVAL;
 	}
 
+	if (unlikely(!(READ_ONCE(tun->dev->flags) & IFF_UP))) {
+		put_page(virt_to_head_page(xdp->data));
+		dev_core_stats_rx_dropped_inc(tun->dev);
+		return -EIO;
+	}
+
 	xdp_prog = rcu_dereference(tun->xdp_prog);
 	if (xdp_prog) {
 		if (gso->gso_type) {
-- 
2.56.0

Re: [PATCH net] tun: drop batched packets while the device is down

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net] tun: drop batched packets while the device is down

[Willem de Bruijn]

Xiao Liang wrote:
> tun_sendmsg() handles TUN_MSG_PTR batches from vhost-net by calling
> tun_xdp_one() instead of tun_get_user(). But this path does not check
> IFF_UP, allowing packets from a guest to be injected into the host
> receive path while the device is administratively down.
> 
> Check IFF_UP in tun_xdp_one() before running XDP or building an skb.
> Drop the packet when the device is down, matching tun_get_user().
> 
> Fixes: 043d222f93ab ("tuntap: accept an array of XDP buffs through sendmsg()")
> Signed-off-by: Xiao Liang <shaw.leon@gmail.com>

Reviewed-by: Willem de Bruijn <willemb@google.com>

Re: [PATCH net] tun: drop batched packets while the device is down

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue, 27 Oct 2026 18:18:27 +0800 you wrote:
> tun_sendmsg() handles TUN_MSG_PTR batches from vhost-net by calling
> tun_xdp_one() instead of tun_get_user(). But this path does not check
> IFF_UP, allowing packets from a guest to be injected into the host
> receive path while the device is administratively down.
> 
> Check IFF_UP in tun_xdp_one() before running XDP or building an skb.
> Drop the packet when the device is down, matching tun_get_user().
> 
> [...]

Here is the summary with links:
  - [net] tun: drop batched packets while the device is down
    https://git.kernel.org/netdev/net/c/8f44631ba02a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html