From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stanislav Fomichev Subject: [PATCH net v2 2/2] tun: always set skb->dev to tun->dev Date: Mon, 7 Jan 2019 13:38:39 -0800 Message-ID: <20190107213839.83297-2-sdf@google.com> References: <20190107213839.83297-1-sdf@google.com> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Cc: davem@davemloft.net, jasowang@redhat.com, brouer@redhat.com, mst@redhat.com, edumazet@google.com, Stanislav Fomichev , syzbot To: netdev@vger.kernel.org Return-path: Received: from mail-pg1-f201.google.com ([209.85.215.201]:55847 "EHLO mail-pg1-f201.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726974AbfAGViq (ORCPT ); Mon, 7 Jan 2019 16:38:46 -0500 Received: by mail-pg1-f201.google.com with SMTP id g188so811731pgc.22 for ; Mon, 07 Jan 2019 13:38:45 -0800 (PST) In-Reply-To: <20190107213839.83297-1-sdf@google.com> Sender: netdev-owner@vger.kernel.org List-ID: While debugging previous issue I noticed that commit 90e33d459407 ("tun: enable napi_gro_frags() for TUN/TAP driver") started conditionally (!frags) calling eth_type_trans(skb, tun->dev) for IFF_TAP case. Since eth_type_trans sets skb->dev, some skbs can now have NULL skb->dev. Fix that by always setting skb->dev unconditionally. The syzbot fails with the following trace: WARNING: CPU: 0 PID: 11136 at net/core/flow_dissector.c:764 skb_flow_dissect_flow_keys_basic include/linux/skbuff.h:1240 [inline] skb_probe_transport_header include/linux/skbuff.h:2403 [inline] tun_get_user+0x2d4a/0x4250 drivers/net/tun.c:1906 tun_chr_write_iter+0xb9/0x160 drivers/net/tun.c:1993 call_write_iter include/linux/fs.h:1808 [inline] new_sync_write fs/read_write.c:474 [inline] But I don't think there is an actual issue since we exercise flow dissector via eth_get_headlen which doesn't use skb (and hence BPF flow dissector). But let's still properly set skb->dev so we don't have any problems going forward. Reported-by: syzbot Fixes: 90e33d459407 ("tun: enable napi_gro_frags() for TUN/TAP driver") Signed-off-by: Stanislav Fomichev --- drivers/net/tun.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 18656c4094b3..2dea2fb88b62 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -1890,6 +1890,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, return -EINVAL; } + skb->dev = tun->dev; switch (tun->flags & TUN_TYPE_MASK) { case IFF_TUN: if (tun->flags & IFF_NO_PI) { @@ -1911,7 +1912,6 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, skb_reset_mac_header(skb); skb->protocol = pi.proto; - skb->dev = tun->dev; break; case IFF_TAP: if (!frags) -- 2.20.1.97.g81188d93c3-goog