Re: [PATCH] tun: Fix use-after-free in tun_net_xmit
From: Cong Wang <hidden>
Date: 2019-04-29 16:58:58
Also in:
lkml
Subsystem:
networking drivers, the rest, tun/tap driver · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds, Willem de Bruijn, Jason Wang
On Mon, Apr 29, 2019 at 7:55 AM Michael S. Tsirkin [off-list ref] wrote:
The problem seems real enough, but an extra synchronize_net on tun_attach might be a problem, slowing guest startup significantly. Better ideas?
Yes, I proposed the following patch in the other thread.
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index e9ca1c088d0b..31c3210288cb 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c@@ -3431,6 +3431,7 @@ static int tun_chr_open(struct inode *inode,struct file * file)
file->private_data = tfile;
INIT_LIST_HEAD(&tfile->next);
+ sock_set_flag(&tfile->sk, SOCK_RCU_FREE);
sock_set_flag(&tfile->sk, SOCK_ZEROCOPY);
return 0;