Similarly to tx ring, xdp_rxq_info is only registered when !tfile->detached, so we need to avoid calling xdp_rxq_info_unreg() twice too. The helper tun_cleanup_tx_ring() already checks for this properly, so it is correct to put xdp_rxq_info_unreg() just inside there.
Reported-by: syzbot+1c788d7ce0f0888f1...@syzkaller.appspotmail.com Fixes: 8565d26bcb2f ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net") Cc: Jason Wang <jasow...@redhat.com> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com> --- drivers/net/tun.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 2bc18b16a45b..a0c5cb1a1617 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -774,14 +774,12 @@ static void tun_detach_all(struct net_device *dev) tun_napi_del(tun, tfile); /* Drop read queue */ tun_queue_purge(tfile); - xdp_rxq_info_unreg(&tfile->xdp_rxq); sock_put(&tfile->sk); tun_cleanup_tx_ring(tfile); } list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) { tun_enable_queue(tfile); tun_queue_purge(tfile); - xdp_rxq_info_unreg(&tfile->xdp_rxq); sock_put(&tfile->sk); tun_cleanup_tx_ring(tfile); } -- 2.13.0