Commit c7256f57 authored Sep 28, 2018 by Eric Dumazet Committed by David S. Miller Oct 01, 2018

tun: initialize napi_mutex unconditionally

This is the first part to fix following syzbot report :

console output: https://syzkaller.appspot.com/x/log.txt?x=145378e6400000
kernel config: https://syzkaller.appspot.com/x/.config?x=443816db871edd66
dashboard link: https://syzkaller.appspot.com/bug?extid=e662df0ac1d753b57e80

Following patch is fixing the race condition, but it seems safer
to initialize this mutex at tfile creation anyway.

Fixes: 90e33d45 ("tun: enable napi_gro_frags() for TUN/TAP driver")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: <syzbot+e662df0ac1d753b57e80@syzkaller.appspotmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 06e55add

drivers/net/tun.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -320,7 +320,6 @@ static void tun_napi_init(struct tun_struct tun, struct tun_file tfile,
		netif_napi_add(tun->dev, &tfile->napi, tun_napi_poll,
		NAPI_POLL_WEIGHT);
		napi_enable(&tfile->napi);
		mutex_init(&tfile->napi_mutex);
		}
		}

		@@ -3199,6 +3198,7 @@ static int tun_chr_open(struct inode inode, struct file file)
		return -ENOMEM;
		}

		mutex_init(&tfile->napi_mutex);
		RCU_INIT_POINTER(tfile->tun, NULL);
		tfile->flags = 0;
		tfile->ifindex = 0;