Similarly to tx ring, xdp_rxq_info is only registered
when !tfile->detached, so we need to avoid calling
xdp_rxq_info_unreg() twice too. The helper tun_cleanup_tx_ring()
already checks for this properly, so it is correct to put
xdp_rxq_info_unreg() just inside there.

Reported-by: syzbot+1c788d7ce0f0888f1...@syzkaller.appspotmail.com
Fixes: 8565d26bcb2f ("Merge 
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net")
Cc: Jason Wang <jasow...@redhat.com>
Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com>
---
 drivers/net/tun.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 2bc18b16a45b..a0c5cb1a1617 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -774,14 +774,12 @@ static void tun_detach_all(struct net_device *dev)
                tun_napi_del(tun, tfile);
                /* Drop read queue */
                tun_queue_purge(tfile);
-               xdp_rxq_info_unreg(&tfile->xdp_rxq);
                sock_put(&tfile->sk);
                tun_cleanup_tx_ring(tfile);
        }
        list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) {
                tun_enable_queue(tfile);
                tun_queue_purge(tfile);
-               xdp_rxq_info_unreg(&tfile->xdp_rxq);
                sock_put(&tfile->sk);
                tun_cleanup_tx_ring(tfile);
        }
-- 
2.13.0

Reply via email to