releases/4.14.7/tun-fix-rcu_read_lock-imbalance-in-tun_build_skb.patch

   1 From foo@baz Thu Dec 14 11:45:40 CET 2017
   2 From: Xin Long <lucien.xin@gmail.com>
   3 Date: Sun, 19 Nov 2017 19:31:04 +0800
   4 Subject: tun: fix rcu_read_lock imbalance in tun_build_skb
   5
   6 From: Xin Long <lucien.xin@gmail.com>
   7
   8
   9 [ Upstream commit 654d573845f35017dc397840fa03610fef3d08b0 ]
  10
  11 rcu_read_lock in tun_build_skb is used to rcu_dereference tun->xdp_prog
  12 safely, rcu_read_unlock should be done in every return path.
  13
  14 Now I could see one place missing it, where it returns NULL in switch-case
  15 XDP_REDIRECT,  another palce using rcu_read_lock wrongly, where it returns
  16 NULL in if (xdp_xmit) chunk.
  17
  18 So fix both in this patch.
  19
  20 Fixes: 761876c857cb ("tap: XDP support")
  21 Signed-off-by: Xin Long <lucien.xin@gmail.com>
  22 Signed-off-by: David S. Miller <davem@davemloft.net>
  23 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  24 ---
  25  drivers/net/tun.c |    3 ++-
  26  1 file changed, 2 insertions(+), 1 deletion(-)
  27
  28 --- a/drivers/net/tun.c
  29 +++ b/drivers/net/tun.c
  30 @@ -1326,6 +1326,7 @@ static struct sk_buff *tun_build_skb(str
  31                         err = xdp_do_redirect(tun->dev, &xdp, xdp_prog);
  32                         if (err)
  33                                 goto err_redirect;
  34 +                       rcu_read_unlock();
  35                         return NULL;
  36                 case XDP_TX:
  37                         xdp_xmit = true;
  38 @@ -1358,7 +1359,7 @@ static struct sk_buff *tun_build_skb(str
  39         if (xdp_xmit) {
  40                 skb->dev = tun->dev;
  41                 generic_xdp_tx(skb, xdp_prog);
  42 -               rcu_read_lock();
  43 +               rcu_read_unlock();
  44                 return NULL;
  45         }
  46