[PATCH net] net: tun: stop NAPI when detaching queues

[PATCH net] net: tun: stop NAPI when detaching queues

[Jakub Kicinski]

While looking at a syzbot report I noticed the NAPI only gets
disabled before it's deleted. I think that user can detach
the queue before destroying the device and the NAPI will never
be stopped.

Compile tested only.

Fixes: 943170998b20 ("tun: enable NAPI for TUN/TAP driver")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
CC: maheshb@google.com
CC: peterpenkov96@gmail.com
---
 drivers/net/tun.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 7fd0288c3789..e2eb35887394 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -273,6 +273,12 @@ static void tun_napi_init(struct tun_struct *tun, struct tun_file *tfile,
 	}
 }
 
+static void tun_napi_enable(struct tun_file *tfile)
+{
+	if (tfile->napi_enabled)
+		napi_enable(&tfile->napi);
+}
+
 static void tun_napi_disable(struct tun_file *tfile)
 {
 	if (tfile->napi_enabled)
@@ -653,8 +659,10 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
 		if (clean) {
 			RCU_INIT_POINTER(tfile->tun, NULL);
 			sock_put(&tfile->sk);
-		} else
+		} else {
 			tun_disable_queue(tun, tfile);
+			tun_napi_disable(tfile);
+		}
 
 		synchronize_net();
 		tun_flow_delete_by_queue(tun, tun->numqueues + 1);
@@ -808,6 +816,7 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
 
 	if (tfile->detached) {
 		tun_enable_queue(tfile);
+		tun_napi_enable(tfile);
 	} else {
 		sock_hold(&tfile->sk);
 		tun_napi_init(tun, tfile, napi, napi_frags);
-- 
2.36.1

Re: [PATCH net] net: tun: stop NAPI when detaching queues

[Petar Penkov]

Thanks for the fix (and for the syzbot one)!

Acked-by: Petar Penkov <ppenkov@aviatrix.com>


On Wed, Jun 22, 2022 at 9:21 PM Jakub Kicinski <kuba@kernel.org> wrote:
>
> While looking at a syzbot report I noticed the NAPI only gets
> disabled before it's deleted. I think that user can detach
> the queue before destroying the device and the NAPI will never
> be stopped.
>
> Compile tested only.
>
> Fixes: 943170998b20 ("tun: enable NAPI for TUN/TAP driver")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
> CC: maheshb@google.com
> CC: peterpenkov96@gmail.com
> ---
>  drivers/net/tun.c | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/tun.c b/drivers/net/tun.c
> index 7fd0288c3789..e2eb35887394 100644
> --- a/drivers/net/tun.c
> +++ b/drivers/net/tun.c
> @@ -273,6 +273,12 @@ static void tun_napi_init(struct tun_struct *tun, struct tun_file *tfile,
>         }
>  }
>
> +static void tun_napi_enable(struct tun_file *tfile)
> +{
> +       if (tfile->napi_enabled)
> +               napi_enable(&tfile->napi);
> +}
> +
>  static void tun_napi_disable(struct tun_file *tfile)
>  {
>         if (tfile->napi_enabled)
> @@ -653,8 +659,10 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
>                 if (clean) {
>                         RCU_INIT_POINTER(tfile->tun, NULL);
>                         sock_put(&tfile->sk);
> -               } else
> +               } else {
>                         tun_disable_queue(tun, tfile);
> +                       tun_napi_disable(tfile);
> +               }
>
>                 synchronize_net();
>                 tun_flow_delete_by_queue(tun, tun->numqueues + 1);
> @@ -808,6 +816,7 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
>
>         if (tfile->detached) {
>                 tun_enable_queue(tfile);
> +               tun_napi_enable(tfile);
>         } else {
>                 sock_hold(&tfile->sk);
>                 tun_napi_init(tun, tfile, napi, napi_frags);
> --
> 2.36.1
>

Re: [PATCH net] net: tun: stop NAPI when detaching queues

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (master)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 22 Jun 2022 21:21:05 -0700 you wrote:
> While looking at a syzbot report I noticed the NAPI only gets
> disabled before it's deleted. I think that user can detach
> the queue before destroying the device and the NAPI will never
> be stopped.
> 
> Compile tested only.
> 
> [...]

Here is the summary with links:
  - [net] net: tun: stop NAPI when detaching queues
    https://git.kernel.org/netdev/net/c/a8fc8cb5692a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html