tuntap: correctly wake up process during uninit (addf8fc4) · Commits · 戴 / test

We used to check dev->reg_state against NETREG_REGISTERED after each time we are woke up. But after commit ("net-tun: restructure tun_do_read for better sleep/wakeup efficiency"), it uses skb_recv_datagram() which does not check dev->reg_state. This will result if we delete a tun/tap device after a process is blocked in the reading. The device will wait for the reference count which was held by that process for ever. Fixes this by using RCV_SHUTDOWN which will be checked during sk_recv_datagram() before trying to wake up the process during uninit. Fixes: ("net-tun: restructure tun_do_read for better sleep/wakeup efficiency") Cc: Eric Dumazet <edumazet@google.com> Cc: Xi Wang <xii@google.com> Cc: Michael S. Tsirkin <mst@redhat.com> Signed-off-by:

Jason Wang <jasowang@redhat.com> Acked-by:

Eric Dumazet <edumazet@google.com> Acked-by:

Michael S. Tsirkin <mst@redhat.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

drivers/net/tun.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -580,11 +580,13 @@ static void tun_detach_all(struct net_device *dev)
		for (i = 0; i < n; i++) {
		tfile = rtnl_dereference(tun->tfiles[i]);
		BUG_ON(!tfile);
		tfile->socket.sk->sk_shutdown = RCV_SHUTDOWN;
		tfile->socket.sk->sk_data_ready(tfile->socket.sk);
		RCU_INIT_POINTER(tfile->tun, NULL);
		--tun->numqueues;
		}
		list_for_each_entry(tfile, &tun->disabled, next) {
		tfile->socket.sk->sk_shutdown = RCV_SHUTDOWN;
		tfile->socket.sk->sk_data_ready(tfile->socket.sk);
		RCU_INIT_POINTER(tfile->tun, NULL);
		}
		@@ -641,6 +643,7 @@ static int tun_attach(struct tun_struct tun, struct file file, bool skip_filte
		goto out;
		}
		tfile->queue_index = tun->numqueues;
		tfile->socket.sk->sk_shutdown &= ~RCV_SHUTDOWN;
		rcu_assign_pointer(tfile->tun, tun);
		rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
		tun->numqueues++;
		@@ -1491,9 +1494,6 @@ static ssize_t tun_do_read(struct tun_struct tun, struct tun_file tfile,
		if (!iov_iter_count(to))
		return 0;

		if (tun->dev->reg_state != NETREG_REGISTERED)
		return -EIO;

		/* Read frames from queue */
		skb = __skb_recv_datagram(tfile->socket.sk, noblock ? MSG_DONTWAIT : 0,
		&peeked, &off, &err);

Admin message