tuntap: correctly wake up process during uninit
authorJason Wang <jasowang@redhat.com>
Thu, 19 May 2016 05:36:51 +0000 (13:36 +0800)
committerSasha Levin <sasha.levin@oracle.com>
Mon, 11 Jul 2016 03:07:29 +0000 (23:07 -0400)
commit27b56c6154943a860c9266ec8f3dc96ba2b1aa19
treeb833f4bde2f3b8d6b10d52064558b1c2a5899b18
parent8454d6443c84ee3501de20b9ff2034ea4767a0da
tuntap: correctly wake up process during uninit

[ Upstream commit addf8fc4acb1cf79492ac64966f07178793cb3d7 ]

We used to check dev->reg_state against NETREG_REGISTERED after each
time we are woke up. But after commit 9e641bdcfa4e ("net-tun:
restructure tun_do_read for better sleep/wakeup efficiency"), it uses
skb_recv_datagram() which does not check dev->reg_state. This will
result if we delete a tun/tap device after a process is blocked in the
reading. The device will wait for the reference count which was held
by that process for ever.

Fixes this by using RCV_SHUTDOWN which will be checked during
sk_recv_datagram() before trying to wake up the process during uninit.

Fixes: 9e641bdcfa4e ("net-tun: restructure tun_do_read for better
sleep/wakeup efficiency")
Cc: Eric Dumazet <edumazet@google.com>
Cc: Xi Wang <xii@google.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
drivers/net/tun.c