Re: [PATCH net] net: tun: hold napi_mutex when deleting NAPI in tun_detach_all()

[Willem de Bruijn <willemdebruijn.kernel@gmail.com>]

Cheng Yongkang wrote:
> With IFF_NAPI_FRAGS, tun_get_user() takes tfile->napi_mutex, gets the
> skb from napi_get_frags() and copies the user data into it before it
> enters the RCU read-side section around napi_gro_frags().
> 
> tun_detach_all() waits with synchronize_net() and then calls
> tun_napi_del() without napi_mutex.  netif_napi_del() frees napi->skb
> through napi_free_frags().  A writer that is still copying has not yet
> entered its RCU section, so synchronize_net() does not wait for it, and
> deleting the device frees the skb while the writer is using it:
> 
>   BUG: KASAN: slab-use-after-free in skb_copy_datagram_from_iter+0x175/0x720
>   Read of size 8 at addr ffff888077def990 by task br029-poc/9406
>   Call Trace:
>    skb_copy_datagram_from_iter+0x175/0x720
>    tun_get_user+0xb42/0x3d00
>    tun_chr_write_iter+0x113/0x200
>   ...
>   Freed by task 9405:
>    kmem_cache_free+0x184/0x670
>    __netif_napi_del_locked+0x2bb/0x3c0
>    tun_net_uninit+0x566/0xa70
>    unregister_netdevice_many_notify+0x1a26/0x2090
>    rtnl_dellink+0x514/0x710
> 
> __tun_detach() also calls tun_napi_del() without the mutex, but only
> from tun_chr_close(), when no write on that file can be in flight.
> 
> Take napi_mutex around tun_napi_del() in tun_detach_all() for both
> attached and disabled queues.
> 
> Fixes: 90e33d459407 ("tun: enable napi_gro_frags() for TUN/TAP driver")
> Assisted-by: LLM
> Signed-off-by: Cheng Yongkang <teel4res@gmail.com>

Reviewed-by: Willem de Bruijn <willemb@google.com>