Re: [PATCH net] net: tun: hold napi_mutex when deleting NAPI in tun_detach_all()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@xxxxxxxxxx>:

On Thu, 22 Oct 2026 08:26:48 -0700 you wrote:
> With IFF_NAPI_FRAGS, tun_get_user() takes tfile->napi_mutex, gets the
> skb from napi_get_frags() and copies the user data into it before it
> enters the RCU read-side section around napi_gro_frags().
> 
> tun_detach_all() waits with synchronize_net() and then calls
> tun_napi_del() without napi_mutex.  netif_napi_del() frees napi->skb
> through napi_free_frags().  A writer that is still copying has not yet
> entered its RCU section, so synchronize_net() does not wait for it, and
> deleting the device frees the skb while the writer is using it:
> 
> [...]

Here is the summary with links:
  - [net] net: tun: hold napi_mutex when deleting NAPI in tun_detach_all()
    https://git.kernel.org/netdev/net/c/6c799b4998c8

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html