Re: [PATCH v3] tun: fix use-after-free when register netdev failed

[Jason Wang <jasowang@redhat.com>]

On 2019/8/20 上午9:25, David Miller wrote:
> From: Yang Yingliang <yangyingliang@huawei.com>
> Date: Mon, 19 Aug 2019 21:31:19 +0800
>
>> Call tun_attach() after register_netdevice() to make sure tfile->tun
>> is not published until the netdevice is registered. So the read/write
>> thread can not use the tun pointer that may freed by free_netdev().
>> (The tun and dev pointer are allocated by alloc_netdev_mqs(), they can
>> be freed by netdev_freemem().)
> register_netdevice() must always be the last operation in the order of
> network device setup.
>
> At the point register_netdevice() is called, the device is visible globally
> and therefore all of it's software state must be fully initialized and
> ready for us.
>
> You're going to have to find another solution to these problems.


The device is loosely coupled with sockets/queues. Each side is allowed 
to be go away without caring the other side. So in this case, there's a 
small window that network stack think the device has one queue but 
actually not, the code can then safely drop them. Maybe it's ok here 
with some comments?

Or if not, we can try to hold the device before tun_attach and drop it 
after register_netdevice().

Thanks