From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stanislav Fomichev Subject: [PATCH net 2/2] tun: always set skb->dev to tun->dev Date: Mon, 7 Jan 2019 12:02:24 -0800 Message-ID: <20190107200224.220467-2-sdf@google.com> References: <20190107200224.220467-1-sdf@google.com> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Cc: davem@davemloft.net, jasowang@redhat.com, brouer@redhat.com, mst@redhat.com, edumazet@google.com, Stanislav Fomichev , syzbot To: netdev@vger.kernel.org Return-path: Received: from mail-qt1-f201.google.com ([209.85.160.201]:36992 "EHLO mail-qt1-f201.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726689AbfAGUCb (ORCPT ); Mon, 7 Jan 2019 15:02:31 -0500 Received: by mail-qt1-f201.google.com with SMTP id d31so1346822qtc.4 for ; Mon, 07 Jan 2019 12:02:30 -0800 (PST) In-Reply-To: <20190107200224.220467-1-sdf@google.com> Sender: netdev-owner@vger.kernel.org List-ID: While debugging previous issue I noticed that commit 90e33d459407 ("tun: enable napi_gro_frags() for TUN/TAP driver") started conditionally (!frags) calling eth_type_trans(skb, tun->dev) for IFF_TAP case. Since eth_type_trans sets skb->dev, some skbs can now have NULL skb->dev. Fix that by always setting skb->dev unconditionally. The syzbot fails with the following trace: WARNING: CPU: 0 PID: 11136 at net/core/flow_dissector.c:764 skb_flow_dissect_flow_keys_basic include/linux/skbuff.h:1240 [inline] skb_probe_transport_header include/linux/skbuff.h:2403 [inline] tun_get_user+0x2d4a/0x4250 drivers/net/tun.c:1906 tun_chr_write_iter+0xb9/0x160 drivers/net/tun.c:1993 call_write_iter include/linux/fs.h:1808 [inline] new_sync_write fs/read_write.c:474 [inline] But I don't think there is an actual issue since we exercise flow dissector via eth_get_headlen which doesn't use skb (and hence BPF flow dissector). But let's still properly set skb->dev so we don't have any problems going forward. Reported-by: syzbot Fixes: 90e33d459407 ("tun: enable napi_gro_frags() for TUN/TAP driver") Signed-off-by: Stanislav Fomichev --- drivers/net/tun.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 7875f06011f2..af34baf978f3 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -1899,6 +1899,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, return -EINVAL; } + skb->dev = tun->dev; switch (tun->flags & TUN_TYPE_MASK) { case IFF_TUN: if (tun->flags & IFF_NO_PI) { @@ -1920,7 +1921,6 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, skb_reset_mac_header(skb); skb->protocol = pi.proto; - skb->dev = tun->dev; break; case IFF_TAP: if (!frags) -- 2.20.1.97.g81188d93c3-goog