Eric Dumazet aec72f3392 net-tun: fix panics at dismantle time ... syzkaller got crashes at dismantle time [1] It is not correct to test (tun->flags & IFF_NAPI) in tun_napi_disable() and tun_napi_del() : Each tun_file can have different mode, depending on how they were created. Similarly I have changed tun_get_user() and tun_poll_controller() to use the new tfile->napi_enabled boolean. [ 154.331360] BUG: unable to handle kernel NULL pointer dereference at (null) [ 154.339220] IP: [<ffffffff9634cad6>] hrtimer_active+0x26/0x60 [ 154.344983] PGD 0 [ 154.347009] Oops: 0000 [#1] SMP [ 154.350680] gsmi: Log Shutdown Reason 0x03 [ 154.379572] task: ffff994719150dc0 ti: ffff99475c0ae000 task.ti: ffff99475c0ae000 [ 154.387043] RIP: 0010:[<ffffffff9634cad6>] [<ffffffff9634cad6>] hrtimer_active+0x26/0x60 [ 154.395232] RSP: 0018:ffff99475c0afce8 EFLAGS: 00010246 [ 154.400542] RAX: ffff994754850ac0 RBX: ffff994753e65408 RCX: ffff994753e65388 [ 154.407666] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff994753e65408 [ 154.414790] RBP: ffff99475c0afce8 R08: 0000000000000000 R09: 0000000000000000 [ 154.421921] R10: ffff99475f6f5910 R11: 0000000000000001 R12: 0000000000000000 [ 154.429044] R13: ffff99417deab668 R14: ffff99417deaa780 R15: ffff99475f45dde0 [ 154.436174] FS: 0000000000000000(0000) GS:ffff994767a00000(0000) knlGS:0000000000000000 [ 154.444249] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 154.449986] CR2: 0000000000000000 CR3: 00000005a8a0e000 CR4: 0000000000022670 [ 154.457110] Stack: [ 154.459120] ffff99475c0afd28 ffffffff9634d614 1000000000000000 0000000000000000 [ 154.466598] ffffe54240000000 ffff994753e65408 ffff994753e653a8 ffff99417deab668 [ 154.474067] ffff99475c0afd48 ffffffff9634d6fd ffff99474c2be678 ffff994753e65398 [ 154.481537] Call Trace: [ 154.483985] [<ffffffff9634d614>] hrtimer_try_to_cancel+0x24/0xf0 [ 154.490074] [<ffffffff9634d6fd>] hrtimer_cancel+0x1d/0x30 [ 154.495563] [<ffffffff96860b3c>] napi_disable+0x3c/0x70 [ 154.500875] [<ffffffff9678ae62>] __tun_detach+0xd2/0x360 [ 154.506272] [<ffffffff9678b117>] tun_chr_close+0x27/0x40 [ 154.511669] [<ffffffff9646ebe6>] __fput+0xd6/0x1e0 [ 154.516548] [<ffffffff9646ed3e>] ____fput+0xe/0x10 [ 154.521429] [<ffffffff963035a2>] task_work_run+0x72/0x90 [ 154.526827] [<ffffffff962e9407>] do_exit+0x317/0xb60 [ 154.531879] [<ffffffff962e9c8f>] do_group_exit+0x3f/0xa0 [ 154.537275] [<ffffffff962e9d07>] SyS_exit_group+0x17/0x20 [ 154.542769] [<ffffffff969784be>] entry_SYSCALL_64_fastpath+0x12/0x17 Fixes: 943170998b ("net-tun: enable NAPI for TUN/TAP driver") Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-10-20 13:31:26 +01:00
..
appletalk	drivers/net/appletalk: Convert timers to use timer_setup()	2017-10-18 12:39:55 +01:00
arcnet	drivers: net: arcnet: use setup_timer() helper.	2017-09-21 11:44:42 -07:00
bonding	net: bonding: Add extack messages for some enslave failures	2017-10-04 21:39:34 -07:00
caif	drivers: net: caif: use setup_timer() helper.	2017-09-21 11:44:43 -07:00
can	drivers: net: can: sja1000: use setup_timer() helper.	2017-09-21 11:44:43 -07:00
cris
dsa	net: dsa: add dsa_to_port helper	2017-10-18 12:24:33 +01:00
ethernet	mlxsw: spectrum_router: Add extack message for RIF and VRF overflow	2017-10-20 13:15:07 +01:00
fddi
fjes
hamradio	hamradio/scc: Convert timers to use timer_setup()	2017-10-18 12:40:26 +01:00
hippi	drivers: net: hippi: use setup_timer() helper.	2017-09-21 11:44:41 -07:00
hyperv	hv_netvsc: Add initialization of tx_table in netvsc_device_add()	2017-10-14 18:42:55 -07:00
ieee802154	ieee802154: atusb: Driver for Busware HUL dongle	2017-09-20 13:37:16 +02:00
ipvlan	net: Add extack to validator_info structs used for address notifier	2017-10-20 13:15:07 +01:00
phy	net: phy: broadcom: support new device flag for setting master mode	2017-10-12 22:59:38 -07:00
plip
ppp	ppp: fix race in ppp device destruction	2017-10-06 10:16:34 -07:00
slip	drivers: net: slip: use setup_timer() helper.	2017-09-21 11:44:40 -07:00
team	net: Add extack to upper device linking	2017-10-04 21:39:33 -07:00
usb	net: usb: Convert timers to use timer_setup()	2017-10-18 12:40:26 +01:00
vmxnet3
wan	hdlc: Convert timers to use timer_setup()	2017-10-18 12:39:55 +01:00
wimax
wireless	wireless-drivers-next patches for 4.15	2017-10-20 08:37:28 +01:00
xen-netback	net/xen-netback: Convert timers to use timer_setup()	2017-10-18 12:40:27 +01:00
dummy.c	net: remove MTU limits for dummy and ifb device	2017-09-25 16:26:09 -07:00
eql.c	drivers: net: eql: use setup_timer() helper.	2017-09-21 11:44:42 -07:00
geneve.c
gtp.c
ifb.c	net: remove MTU limits for dummy and ifb device	2017-09-25 16:26:09 -07:00
Kconfig	net: Add support for networking over Thunderbolt cable	2017-10-02 11:24:42 -07:00
LICENSE.SRC
loopback.c
macsec.c	net: Add extack to upper device linking	2017-10-04 21:39:33 -07:00
macvlan.c	macvlan/macvtap: Add support for L2 forwarding offloads with macvtap	2017-10-19 12:43:59 +01:00
macvtap.c	net: Add extack to upper device linking	2017-10-04 21:39:33 -07:00
Makefile	net: Add support for networking over Thunderbolt cable	2017-10-02 11:24:42 -07:00
mdio.c
mii.c
netconsole.c
nlmon.c
ntb_netdev.c
rionet.c
sb1000.c
Space.c
sungem_phy.c
tap.c
thunderbolt.c	thunderbolt: Right shifting to zero bug in tbnet_handle_packet()	2017-10-19 13:04:32 +01:00
tun.c	net-tun: fix panics at dismantle time	2017-10-20 13:31:26 +01:00
veth.c
virtio_net.	virtio-net: support XDP_REDIRECT	2017-09-20 14:27:52 -07:00
virtio_net.c	bpf: add meta pointer for direct access	2017-09-26 13:36:44 -07:00
vrf.c	net: vrf: Add extack messages for enslave errors	2017-10-04 21:39:33 -07:00
vsockmon.c
vxlan.c
xen-netfront.c	xen-netfront: be more drop monitor friendly	2017-08-30 15:56:16 -07:00