mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-30 11:03:07 -04:00
Code Issues Packages Projects Releases Wiki Activity

tun: no longer rely on RTNL in tun_fill_info()

Browse Source 
Update tun_fill_info() to read device configuration fields (flags, owner,
group, numqueues, numdisabled) locklessly using READ_ONCE().

Annotate all writes to these fields in the control paths with WRITE_ONCE()
to prevent data races, as these fields can be modified concurrently via
ioctls (TUNSETPERSIST, TUNSETOWNER, TUNSETGROUP, TUNSETIFF) or queue
attaching/detaching.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260706163517.2415530-1-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
Eric Dumazet
2026-07-06 16:35:17 +00:00
committed by Paolo Abeni
parent d5d7554052
commit 23dad2d088
2 changed files with 36 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
drivers/net/tun.c
View File

@@ -532,7 +532,7 @@ static void tun_disable_queue(struct tun_struct *tun, struct tun_file *tfile)
{ {
tfile->detached = tun; tfile->detached = tun;
list_add_tail(&tfile->next, &tun->disabled); list_add_tail(&tfile->next, &tun->disabled);
++tun->numdisabled; WRITE_ONCE(tun->numdisabled, tun->numdisabled + 1);
} }
static struct tun_struct *tun_enable_queue(struct tun_file *tfile) static struct tun_struct *tun_enable_queue(struct tun_file *tfile)
@@ -541,7 +541,7 @@ static struct tun_struct *tun_enable_queue(struct tun_file *tfile)
tfile->detached = NULL; tfile->detached = NULL;
list_del_init(&tfile->next); list_del_init(&tfile->next);
--tun->numdisabled; WRITE_ONCE(tun->numdisabled, tun->numdisabled - 1);
return tun; return tun;
} }
@@ -600,7 +600,7 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
rcu_assign_pointer(tun->tfiles[tun->numqueues - 1], rcu_assign_pointer(tun->tfiles[tun->numqueues - 1],
NULL); NULL);
--tun->numqueues; WRITE_ONCE(tun->numqueues, tun->numqueues - 1);
if (clean) { if (clean) {
RCU_INIT_POINTER(tfile->tun, NULL); RCU_INIT_POINTER(tfile->tun, NULL);
sock_put(&tfile->sk); sock_put(&tfile->sk);
@@ -663,7 +663,7 @@ static void tun_detach_all(struct net_device *dev)
tfile->socket.sk->sk_shutdown = RCV_SHUTDOWN; tfile->socket.sk->sk_shutdown = RCV_SHUTDOWN;
tfile->socket.sk->sk_data_ready(tfile->socket.sk); tfile->socket.sk->sk_data_ready(tfile->socket.sk);
RCU_INIT_POINTER(tfile->tun, NULL); RCU_INIT_POINTER(tfile->tun, NULL);
--tun->numqueues; WRITE_ONCE(tun->numqueues, tun->numqueues - 1);
} }
list_for_each_entry(tfile, &tun->disabled, next) { list_for_each_entry(tfile, &tun->disabled, next) {
tfile->socket.sk->sk_shutdown = RCV_SHUTDOWN; tfile->socket.sk->sk_shutdown = RCV_SHUTDOWN;
@@ -786,7 +786,7 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
if (publish_tun) if (publish_tun)
rcu_assign_pointer(tfile->tun, tun); rcu_assign_pointer(tfile->tun, tun);
rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile); rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
tun->numqueues++; WRITE_ONCE(tun->numqueues, tun->numqueues + 1);
tun_set_real_num_queues(tun); tun_set_real_num_queues(tun);
out: out:
return err; return err;
@@ -2370,32 +2370,36 @@ static size_t tun_get_size(const struct net_device *dev)
static int tun_fill_info(struct sk_buff *skb, const struct net_device *dev) static int tun_fill_info(struct sk_buff *skb, const struct net_device *dev)
{ {
struct tun_struct *tun = netdev_priv(dev); const struct tun_struct *tun = netdev_priv(dev);
unsigned int flags = READ_ONCE(tun->flags);
kuid_t owner = READ_ONCE(tun->owner);
kgid_t group = READ_ONCE(tun->group);
if (nla_put_u8(skb, IFLA_TUN_TYPE, tun->flags & TUN_TYPE_MASK)) if (nla_put_u8(skb, IFLA_TUN_TYPE, flags & TUN_TYPE_MASK))
goto nla_put_failure; goto nla_put_failure;
if (uid_valid(tun->owner) && if (uid_valid(owner) &&
nla_put_u32(skb, IFLA_TUN_OWNER, nla_put_u32(skb, IFLA_TUN_OWNER,
from_kuid_munged(current_user_ns(), tun->owner))) from_kuid_munged(current_user_ns(), owner)))
goto nla_put_failure; goto nla_put_failure;
if (gid_valid(tun->group) && if (gid_valid(group) &&
nla_put_u32(skb, IFLA_TUN_GROUP, nla_put_u32(skb, IFLA_TUN_GROUP,
from_kgid_munged(current_user_ns(), tun->group))) from_kgid_munged(current_user_ns(), group)))
goto nla_put_failure; goto nla_put_failure;
if (nla_put_u8(skb, IFLA_TUN_PI, !(tun->flags & IFF_NO_PI))) if (nla_put_u8(skb, IFLA_TUN_PI, !(flags & IFF_NO_PI)))
goto nla_put_failure; goto nla_put_failure;
if (nla_put_u8(skb, IFLA_TUN_VNET_HDR, !!(tun->flags & IFF_VNET_HDR))) if (nla_put_u8(skb, IFLA_TUN_VNET_HDR, !!(flags & IFF_VNET_HDR)))
goto nla_put_failure; goto nla_put_failure;
if (nla_put_u8(skb, IFLA_TUN_PERSIST, !!(tun->flags & IFF_PERSIST))) if (nla_put_u8(skb, IFLA_TUN_PERSIST, !!(flags & IFF_PERSIST)))
goto nla_put_failure; goto nla_put_failure;
if (nla_put_u8(skb, IFLA_TUN_MULTI_QUEUE, if (nla_put_u8(skb, IFLA_TUN_MULTI_QUEUE,
!!(tun->flags & IFF_MULTI_QUEUE))) !!(flags & IFF_MULTI_QUEUE)))
goto nla_put_failure; goto nla_put_failure;
if (tun->flags & IFF_MULTI_QUEUE) { if (flags & IFF_MULTI_QUEUE) {
if (nla_put_u32(skb, IFLA_TUN_NUM_QUEUES, tun->numqueues)) if (nla_put_u32(skb, IFLA_TUN_NUM_QUEUES,
READ_ONCE(tun->numqueues)))
goto nla_put_failure; goto nla_put_failure;
if (nla_put_u32(skb, IFLA_TUN_NUM_DISABLED_QUEUES, if (nla_put_u32(skb, IFLA_TUN_NUM_DISABLED_QUEUES,
tun->numdisabled)) READ_ONCE(tun->numdisabled)))
goto nla_put_failure; goto nla_put_failure;
} }
@@ -2814,8 +2818,8 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
return 0; return 0;
} }
tun->flags = (tun->flags & ~TUN_FEATURES) | WRITE_ONCE(tun->flags, (tun->flags & ~TUN_FEATURES) |
(ifr->ifr_flags & TUN_FEATURES); (ifr->ifr_flags & TUN_FEATURES));
netdev_state_change(dev); netdev_state_change(dev);
} else { } else {
@@ -3213,13 +3217,13 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
/* Disable/Enable persist mode. Keep an extra reference to the /* Disable/Enable persist mode. Keep an extra reference to the
* module to prevent the module being unprobed. * module to prevent the module being unprobed.
*/ */
if (arg && !(tun->flags & IFF_PERSIST)) { if (arg && !(READ_ONCE(tun->flags) & IFF_PERSIST)) {
tun->flags |= IFF_PERSIST; WRITE_ONCE(tun->flags, READ_ONCE(tun->flags) | IFF_PERSIST);
__module_get(THIS_MODULE); __module_get(THIS_MODULE);
do_notify = true; do_notify = true;
} }
if (!arg && (tun->flags & IFF_PERSIST)) { if (!arg && (READ_ONCE(tun->flags) & IFF_PERSIST)) {
tun->flags &= ~IFF_PERSIST; WRITE_ONCE(tun->flags, READ_ONCE(tun->flags) & ~IFF_PERSIST);
module_put(THIS_MODULE); module_put(THIS_MODULE);
do_notify = true; do_notify = true;
} }
@@ -3235,10 +3239,10 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
ret = -EINVAL; ret = -EINVAL;
break; break;
} }
tun->owner = owner; WRITE_ONCE(tun->owner, owner);
do_notify = true; do_notify = true;
netif_info(tun, drv, tun->dev, "owner set to %u\n", netif_info(tun, drv, tun->dev, "owner set to %u\n",
from_kuid(&init_user_ns, tun->owner)); from_kuid(&init_user_ns, owner));
break; break;
case TUNSETGROUP: case TUNSETGROUP:
@@ -3248,10 +3252,10 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
ret = -EINVAL; ret = -EINVAL;
break; break;
} }
tun->group = group; WRITE_ONCE(tun->group, group);
do_notify = true; do_notify = true;
netif_info(tun, drv, tun->dev, "group set to %u\n", netif_info(tun, drv, tun->dev, "group set to %u\n",
from_kgid(&init_user_ns, tun->group)); from_kgid(&init_user_ns, group));
break; break;
case TUNSETLINK: case TUNSETLINK:

8
drivers/net/tun_vnet.h
View File

@@ -40,9 +40,9 @@ static inline long tun_set_vnet_be(unsigned int *flags, int __user *argp)
return -EFAULT; return -EFAULT;
if (be) if (be)
*flags |= TUN_VNET_BE; WRITE_ONCE(*flags, *flags | TUN_VNET_BE);
else else
*flags &= ~TUN_VNET_BE; WRITE_ONCE(*flags, *flags & ~TUN_VNET_BE);
return 0; return 0;
} }
@@ -93,9 +93,9 @@ static inline long tun_vnet_ioctl(int *vnet_hdr_sz, unsigned int *flags,
if (get_user(s, sp)) if (get_user(s, sp))
return -EFAULT; return -EFAULT;
if (s) if (s)
*flags |= TUN_VNET_LE; WRITE_ONCE(*flags, *flags | TUN_VNET_LE);
else else
*flags &= ~TUN_VNET_LE; WRITE_ONCE(*flags, *flags & ~TUN_VNET_LE);
return 0; return 0;
case TUNGETVNETBE: case TUNGETVNETBE: