Revision ff1fa2081d173b01cebe2fbf0a2d0f1cee9ce4b5 authored by Jakub Kicinski on 29 June 2022, 18:19:10 UTC, committed by Jakub Kicinski on 30 June 2022, 18:34:10 UTC
Eric reports that syzbot made short work out of my speculative
fix. Indeed when queue gets detached its tfile->tun remains,
so we would try to stop NAPI twice with a detach(), close()
sequence.
Alternative fix would be to move tun_napi_disable() to
tun_detach_all() and let the NAPI run after the queue
has been detached.
Fixes: a8fc8cb5692a ("net: tun: stop NAPI when detaching queues")
Reported-by: syzbot <syzkaller@googlegroups.com>
Reported-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20220629181911.372047-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
1 parent 9c5de24
| File | Mode | Size |
|---|---|---|
| Kconfig | -rw-r--r-- | 529 bytes |
| Makefile | -rw-r--r-- | 378 bytes |
| ast.c | -rw-r--r-- | 8.2 KB |
| ast.h | -rw-r--r-- | 1.1 KB |
| config.c | -rw-r--r-- | 23.2 KB |
| config.h | -rw-r--r-- | 1.4 KB |
| debug_fs.c | -rw-r--r-- | 21.5 KB |
| dir.c | -rw-r--r-- | 7.3 KB |
| dir.h | -rw-r--r-- | 889 bytes |
| dlm_internal.h | -rw-r--r-- | 20.8 KB |
| lock.c | -rw-r--r-- | 162.2 KB |
| lock.h | -rw-r--r-- | 3.2 KB |
| lockspace.c | -rw-r--r-- | 21.0 KB |
| lockspace.h | -rw-r--r-- | 940 bytes |
| lowcomms.c | -rw-r--r-- | 47.2 KB |
| lowcomms.h | -rw-r--r-- | 1.9 KB |
| lvb_table.h | -rw-r--r-- | 541 bytes |
| main.c | -rw-r--r-- | 1.9 KB |
| member.c | -rw-r--r-- | 16.4 KB |
| member.h | -rw-r--r-- | 1.3 KB |
| memory.c | -rw-r--r-- | 3.1 KB |
| memory.h | -rw-r--r-- | 1.2 KB |
| midcomms.c | -rw-r--r-- | 37.9 KB |
| midcomms.h | -rw-r--r-- | 1.5 KB |
| netlink.c | -rw-r--r-- | 2.8 KB |
| plock.c | -rw-r--r-- | 11.1 KB |
| rcom.c | -rw-r--r-- | 17.0 KB |
| rcom.h | -rw-r--r-- | 987 bytes |
| recover.c | -rw-r--r-- | 22.8 KB |
| recover.h | -rw-r--r-- | 1.3 KB |
| recoverd.c | -rw-r--r-- | 8.1 KB |
| recoverd.h | -rw-r--r-- | 781 bytes |
| requestqueue.c | -rw-r--r-- | 5.0 KB |
| requestqueue.h | -rw-r--r-- | 736 bytes |
| user.c | -rw-r--r-- | 24.5 KB |
| user.h | -rw-r--r-- | 440 bytes |
| util.c | -rw-r--r-- | 1.6 KB |
| util.h | -rw-r--r-- | 545 bytes |
Computing file changes ...
