Re: [PATCH net V2] tun: fix use after free for ptr_ring

On 2018年05月12日 01:39, Cong Wang wrote:

On Thu, May 10, 2018 at 7:49 PM, Jason Wang [off-list ref] wrote:

quoted

  static void __tun_detach(struct tun_file *tfile, bool clean)
  {
         struct tun_file *ntfile;

@@ -736,7 +727,8 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
                             tun->dev->reg_state == NETREG_REGISTERED)
                                 unregister_netdevice(tun->dev);
                 }
-               tun_cleanup_tx_ring(tfile);
+               if (tun)
+                       xdp_rxq_info_unreg(&tfile->xdp_rxq);
                 sock_put(&tfile->sk);
         }
  }

@@ -783,14 +775,14 @@ static void tun_detach_all(struct net_device *dev)
                 tun_napi_del(tun, tfile);
                 /* Drop read queue */
                 tun_queue_purge(tfile);
+               xdp_rxq_info_unreg(&tfile->xdp_rxq);
                 sock_put(&tfile->sk);
-               tun_cleanup_tx_ring(tfile);
         }
         list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) {
                 tun_enable_queue(tfile);
                 tun_queue_purge(tfile);
+               xdp_rxq_info_unreg(&tfile->xdp_rxq);
                 sock_put(&tfile->sk);
-               tun_cleanup_tx_ring(tfile);

Are you sure t is safe?

xdp_rxq_info_unreg() can't be called more than once either,
please make sure the warning that commit c13da21cdb80
("tun: avoid calling xdp_rxq_info_unreg() twice") fixed will not
show up again.

I think it's safe. xdp_rxq_info_unreg() will be called when socket were 
detached from netdevice, and there's only two possible paths: release() 
and uninit(). We've synced them through rtnl lock.

Thanks