Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ea0519bc authored by Jakub Kicinski's avatar Jakub Kicinski Committed by Greg Kroah-Hartman
Browse files

net: tun: stop NAPI when detaching queues 



commit a8fc8cb5692aebb9c6f7afd4265366d25dcd1d01 upstream.

While looking at a syzbot report I noticed the NAPI only gets
disabled before it's deleted. I think that user can detach
the queue before destroying the device and the NAPI will never
be stopped.

Fixes: 94317099 ("tun: enable NAPI for TUN/TAP driver")
Acked-by: default avatarPetar Penkov <ppenkov@aviatrix.com>
Link: https://lore.kernel.org/r/20220623042105.2274812-1-kuba@kernel.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent a8cf9190

drivers/net/tun.c

+10 −1
Original line number Diff line number Diff line
@@ -327,6 +327,12 @@ static void tun_napi_init(struct tun_struct *tun, struct tun_file *tfile, 
	}

}



static void tun_napi_enable(struct tun_file *tfile)

{

	if (tfile->napi_enabled)

		napi_enable(&tfile->napi);

}



static void tun_napi_disable(struct tun_file *tfile)

{

	if (tfile->napi_enabled)
@@ -709,8 +715,10 @@ static void __tun_detach(struct tun_file *tfile, bool clean) 
		if (clean) {

			RCU_INIT_POINTER(tfile->tun, NULL);

			sock_put(&tfile->sk);

		} else

		} else {

			tun_disable_queue(tun, tfile);

			tun_napi_disable(tfile);

		}



		synchronize_net();

		tun_flow_delete_by_queue(tun, tun->numqueues + 1);
@@ -864,6 +872,7 @@ static int tun_attach(struct tun_struct *tun, struct file *file, 


	if (tfile->detached) {

		tun_enable_queue(tfile);

		tun_napi_enable(tfile);

	} else {

		sock_hold(&tfile->sk);

		tun_napi_init(tun, tfile, napi, napi_frags);