Eric reports that syzbot made short work out of my speculative fix. Indeed when queue gets detached its tfile->tun remains, so we would try to stop NAPI twice with a detach(), close() sequence. Alternative fix would be to move tun_napi_disable() to tun_detach_all() and let the NAPI run after the queue has been detached.
Unified · Split
| @@ -640,7 +640,8 @@ static void __tun_detach(struct tun_file *tfile, bool clean) · 639 unmodified lines | ||
| 640 | 640 | tun = rtnl_dereference(tfile->tun); |
| 641 | 641 | |
| 642 | 642 | if (tun && clean) { |
| 643 | − tun_napi_disable(tfile); | |
| 643 | + if (!tfile->detached) | |
| 644 | + tun_napi_disable(tfile); | |
| 644 | 645 | tun_napi_del(tfile); |
| 645 | 646 | } |
| 646 | 647 | |