Eric reports that syzbot made short work out of my speculative fix. Indeed when queue gets detached its tfile->tun remains, so we would try to stop NAPI twice with a detach(), close() sequence. Alternative fix would be to move tun_napi_disable() to tun_detach_all() and let the NAPI run after the queue has been detached.
Unified · Split
| @@ -640,7 +640,8 @@ static void __tun_detach(struct tun_file *tfile, bool clean) · 639 unmodified lines | |||
| 640 | tun = rtnl_dereference(tfile->tun); | 640 | tun = rtnl_dereference(tfile->tun); |
| 641 | 641 | ||
| 642 | if (tun && clean) { | 642 | if (tun && clean) { |
| 643 | tun_napi_disable(tfile); | 643 | if (!tfile->detached) |
| 644 | tun_napi_disable(tfile); | ||
| 644 | tun_napi_del(tfile); | 645 | tun_napi_del(tfile); |
| 645 | } | 646 | } |
| 646 | 647 | ||