Re: [PATCH v2] tun: avoid double free in tun_free_netdev

[Jakub Kicinski]

On Mon, 13 Dec 2021 12:04:11 -0500 George Kennedy wrote:
> Avoid double free in tun_free_netdev() by checking if
> dev->reg_state is NETREG_UNREGISTERING in the tun_set_iff()
> error paths. If dev->reg_state is NETREG_UNREGISTERING that means
> the destructor will be called later.
> 
> BUG: KASAN: double-free or invalid-free in selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605

> 
> Reported-by: syzkaller <syzkaller@xxxxxxxxxxxxxxxx>
> Signed-off-by: George Kennedy <george.kennedy@xxxxxxxxxx>
> ---
> Jakub, decided to go the less code churn route and just
> check for dev->reg_state is NETREG_UNREGISTERING.

I don't think this is correct. E.g. if NETDEV_POST_INIT notifier 
fails the destructor will already have been called and reg_state 
will be NETREG_UNINITIALIZED which is != NETREG_UNREGISTERING.

What I had in mind is replacing if (!dev->tstats) goto .. with 
if (reg_state == NETREG_UNREGISTERING) goto ..

But as proven partial destruction on failure of register_netdevice() is
extra tricky, I believe moving the code into ndo_init would be less
error-prone even if higher LoC delta. Unless there's some trickery in
the code move as well, I haven't investigated.