Re: [PATCH net] tun: delete the flow entries of the moved queue on detach

[Umang Pokhriyal]

On Sun, 08 Nov 2026 17:02:25 +0000, netdev-bot+sashiko@xxxxxxxxxx wrote:
> Can a concurrent write() still put back an entry that points at the old
> index after this delete has run?

Yes. On the write() path tun_flow_update() reads tfile->queue_index
outside any RCU section, and synchronize_net() does not wait for it.
The race predates this patch. Before the patch the entries survived
every detach. With it, only a write() that stalls across the
synchronize_net() can store the old index again.

> There are two possible fixes. One is to read tfile->queue_index and update
> e->queue_index under tun->lock. The other is to have
> tun_automq_select_queue() fall back to reciprocal_scale() when
> e->queue_index >= numqueues. Would either of these work here?

The second one covers both sequences and keeps the write() path
lockless for a known flow. It would be a separate patch for net-next,
since the race is old and has not been seen in practice.