From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B9231CCA47E for ; Thu, 23 Jun 2022 04:41:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231152AbiFWEk2 (ORCPT ); Thu, 23 Jun 2022 00:40:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58280 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345854AbiFWEUu (ORCPT ); Thu, 23 Jun 2022 00:20:50 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A3D582D1E9 for ; Wed, 22 Jun 2022 21:20:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 58BD0B821A7 for ; Thu, 23 Jun 2022 04:20:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C7985C3411B; Thu, 23 Jun 2022 04:20:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1655958047; bh=pXDhgRnCAQcHo4czXek2baUga02PF8hJfKEnTUaZjVs=; h=From:To:Cc:Subject:Date:From; b=NuO1GZzs9y37WnLBUeadyG97PyILWh9w4oYFQcRSKEhFdKJ6ltqJjM82HVJXtxVLe hP1JSoSb4pqD1yezJwyP0BloG7hOqNsq5S39RWpSRR3aqdIOroiByAR/Omt1/ZOyrz mW1I/ft/dnn1LhTc83DTVW9NsKX31bDBnLx2zrim6usb6jscIsDpWpWZI37r7XEAXU is7hYpxAfEtVGcJ+Q55e/FtwuIRw6YpjYXtXXpRMS0Za1/d0iLuIFtN4jxAYZEFNt+ 0zJu5NxlIbM7e1x+b6EJZLwgZJjb+cKMMqYCtgBIwhnnqeHT7WIlTxbV6l7u/MfYeu gy9KtmU5w6NXw== From: Jakub Kicinski To: davem@davemloft.net, edumazet@google.com Cc: netdev@vger.kernel.org, pabeni@redhat.com, Jakub Kicinski , syzbot+b75c138e9286ac742647@syzkaller.appspotmail.com, peterpenkov96@gmail.com, maheshb@google.com Subject: [PATCH net] net: tun: unlink NAPI from device on destruction Date: Wed, 22 Jun 2022 21:20:39 -0700 Message-Id: <20220623042039.2274708-1-kuba@kernel.org> X-Mailer: git-send-email 2.36.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Syzbot found a race between tun file and device destruction. NAPIs live in struct tun_file which can get destroyed before the netdev so we have to del them explicitly. The current code is missing deleting the NAPI if the queue was detached first. Fixes: 943170998b20 ("tun: enable NAPI for TUN/TAP driver") Reported-by: syzbot+b75c138e9286ac742647@syzkaller.appspotmail.com Signed-off-by: Jakub Kicinski --- CC: peterpenkov96@gmail.com CC: maheshb@google.com --- drivers/net/tun.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 87a635aac008..7fd0288c3789 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -727,6 +727,7 @@ static void tun_detach_all(struct net_device *dev) sock_put(&tfile->sk); } list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) { + tun_napi_del(tfile); tun_enable_queue(tfile); tun_queue_purge(tfile); xdp_rxq_info_unreg(&tfile->xdp_rxq); -- 2.36.1