From: Jason Wang jasowang@redhat.com
[ Upstream commit 9871a9e47a2646fe30ae7fd2e67668a8d30912f6 ]
When a queue(tfile) is detached through __tun_detach(), we move the last enabled tfile to the position where detached one sit but don't NULL out last position. We expect to synchronize the datapath through tun->numqueues. Unfortunately, this won't work since we're lacking sufficient mechanism to order or synchronize the access to tun->numqueues.
To fix this, NULL out the last position during detaching and check RCU protected tfile against NULL instead of checking tun->numqueues in datapath.
Cc: YueHaibing yuehaibing@huawei.com Cc: Cong Wang xiyou.wangcong@gmail.com Cc: weiyongjun (A) weiyongjun1@huawei.com Cc: Eric Dumazet eric.dumazet@gmail.com Fixes: c8d68e6be1c3b ("tuntap: multiqueue support") Signed-off-by: Jason Wang jasowang@redhat.com Reviewed-by: Wei Yongjun weiyongjun1@huawei.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/net/tun.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -705,6 +705,8 @@ static void __tun_detach(struct tun_file tun->tfiles[tun->numqueues - 1]); ntfile = rtnl_dereference(tun->tfiles[index]); ntfile->queue_index = index; + rcu_assign_pointer(tun->tfiles[tun->numqueues - 1], + NULL);
--tun->numqueues; if (clean) { @@ -1087,7 +1089,7 @@ static netdev_tx_t tun_net_xmit(struct s tfile = rcu_dereference(tun->tfiles[txq]);
/* Drop packet if interface is not attached */ - if (txq >= tun->numqueues) + if (!tfile) goto drop;
if (!rcu_dereference(tun->steering_prog)) @@ -1310,6 +1312,7 @@ static int tun_xdp_xmit(struct net_devic
rcu_read_lock();
+resample: numqueues = READ_ONCE(tun->numqueues); if (!numqueues) { rcu_read_unlock(); @@ -1318,6 +1321,8 @@ static int tun_xdp_xmit(struct net_devic
tfile = rcu_dereference(tun->tfiles[smp_processor_id() % numqueues]); + if (unlikely(!tfile)) + goto resample;
spin_lock(&tfile->tx_ring.producer_lock); for (i = 0; i < n; i++) {