Re: [PATCH net V2] tun: fix use after free for ptr_ring

[Jason Wang]

On 2018å05æ12æ 01:39, Cong Wang wrote:
> On Thu, May 10, 2018 at 7:49 PM, Jason Wang <jasowang@xxxxxxxxxx> wrote:
> >   static void __tun_detach(struct tun_file *tfile, bool clean)
> >   {
> >          struct tun_file *ntfile;
> > @@ -736,7 +727,8 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
> >                              tun->dev->reg_state == NETREG_REGISTERED)
> >                                  unregister_netdevice(tun->dev);
> >                  }
> > -               tun_cleanup_tx_ring(tfile);
> > +               if (tun)
> > +                       xdp_rxq_info_unreg(&tfile->xdp_rxq);
> >                  sock_put(&tfile->sk);
> >          }
> >   }
> > @@ -783,14 +775,14 @@ static void tun_detach_all(struct net_device *dev)
> >                  tun_napi_del(tun, tfile);
> >                  /* Drop read queue */
> >                  tun_queue_purge(tfile);
> > +               xdp_rxq_info_unreg(&tfile->xdp_rxq);
> >                  sock_put(&tfile->sk);
> > -               tun_cleanup_tx_ring(tfile);
> >          }
> >          list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) {
> >                  tun_enable_queue(tfile);
> >                  tun_queue_purge(tfile);
> > +               xdp_rxq_info_unreg(&tfile->xdp_rxq);
> >                  sock_put(&tfile->sk);
> > -               tun_cleanup_tx_ring(tfile);
> Are you sure t is safe?
>
> xdp_rxq_info_unreg() can't be called more than once either,
> please make sure the warning that commit c13da21cdb80
> ("tun: avoid calling xdp_rxq_info_unreg() twice") fixed will not
> show up again.

I think it's safe. xdp_rxq_info_unreg() will be called when socket were 
detached from netdevice, and there's only two possible paths: release() 
and uninit(). We've synced them through rtnl lock.

Thanks