On 2018年01月11日 02:51, Cong Wang wrote:
tfile->tun could be detached before we close the tun fd,
via tun_detach_all(), so it should not be used to check for
tfile->tx_array.
As Jason suggested, we probably have to clean it up
unconditionally, but this requires to check if it is initialized
or not. Currently skb_array_cleanup() doesn't have such a check,
so I check it in the caller, it is ugly but we can always
improve it in net-next.
Rethink about this, looks like I was wrong. The case I mentioned
previously is
open
attach
detach
close
But during close, we will try to enable tfile through tun_enable_queue()
in __tun_detach(), which means we can do the cleanup for sure.
It looks to me what is actual missed is the cleanups tun_detach_all().
For me the only case that could leak is
open
attach
ip link del link dev tap0
close or another set_iff()
So in this case, clean during close is not sufficient since it could be
attached to another device.
Thanks
Reported-by: Dmitry Vyukov <dvyu...@google.com>
Fixes: 1576d9860599 ("tun: switch to use skb array for tx")
Cc: Jason Wang <jasow...@redhat.com>
Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com>
---
drivers/net/tun.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 4f4a842a1c9c..4c85474ffbaf 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -657,7 +657,7 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
tun->dev->reg_state == NETREG_REGISTERED)
unregister_netdevice(tun->dev);
}
- if (tun)
+ if (tfile->tx_array.ring.queue)
skb_array_cleanup(&tfile->tx_array);
sock_put(&tfile->sk);
}
@@ -2851,6 +2851,8 @@ static int tun_chr_open(struct inode *inode, struct file
* file)
sock_set_flag(&tfile->sk, SOCK_ZEROCOPY);
+ memset(&tfile->tx_array, 0, sizeof(tfile->tx_array));
+
return 0;
}
