Re: [PATCH v2] tun: avoid double free in tun_free_netdev

On Mon, 13 Dec 2021 12:04:11 -0500 George Kennedy wrote:

Avoid double free in tun_free_netdev() by checking if
dev->reg_state is NETREG_UNREGISTERING in the tun_set_iff()
error paths. If dev->reg_state is NETREG_UNREGISTERING that means
the destructor will be called later.

BUG: KASAN: double-free or invalid-free in selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605

Reported-by: syzkaller <redacted>
Signed-off-by: George Kennedy <redacted>
---
Jakub, decided to go the less code churn route and just
check for dev->reg_state is NETREG_UNREGISTERING.

I don't think this is correct. E.g. if NETDEV_POST_INIT notifier 
fails the destructor will already have been called and reg_state 
will be NETREG_UNINITIALIZED which is != NETREG_UNREGISTERING.

What I had in mind is replacing if (!dev->tstats) goto .. with 
if (reg_state == NETREG_UNREGISTERING) goto ..

But as proven partial destruction on failure of register_netdevice() is
extra tricky, I believe moving the code into ndo_init would be less
error-prone even if higher LoC delta. Unless there's some trickery in
the code move as well, I haven't investigated.