diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2022-06-29 11:19:10 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-07-07 17:35:11 +0200 |
| commit | a12fae7621434d0360202156e13969874e002661 (patch) | |
| tree | 5ca3ca41c7a0075199aace7887fde6a918b6e38a /drivers/net/tun.c | |
| parent | 7f349ad933d00b259852497078b694fc42f4db2b (diff) | |
| download | linux-stable-a12fae7621434d0360202156e13969874e002661.tar.gz linux-stable-a12fae7621434d0360202156e13969874e002661.tar.bz2 linux-stable-a12fae7621434d0360202156e13969874e002661.zip | |
net: tun: avoid disabling NAPI twice
commit ff1fa2081d173b01cebe2fbf0a2d0f1cee9ce4b5 upstream.
Eric reports that syzbot made short work out of my speculative
fix. Indeed when queue gets detached its tfile->tun remains,
so we would try to stop NAPI twice with a detach(), close()
sequence.
Alternative fix would be to move tun_napi_disable() to
tun_detach_all() and let the NAPI run after the queue
has been detached.
Fixes: a8fc8cb5692a ("net: tun: stop NAPI when detaching queues")
Reported-by: syzbot <syzkaller@googlegroups.com>
Reported-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20220629181911.372047-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/net/tun.c')
| -rw-r--r-- | drivers/net/tun.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/tun.c b/drivers/net/tun.c index c455545885ca..c3390999842a 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -710,7 +710,8 @@ static void __tun_detach(struct tun_file *tfile, bool clean) tun = rtnl_dereference(tfile->tun); if (tun && clean) { - tun_napi_disable(tfile); + if (!tfile->detached) + tun_napi_disable(tfile); tun_napi_del(tfile); } |