[net] tun: fix a memory leak for tfile->tx_array

tfile->tun could be detached before we close the tun fd,
via tun_detach_all(), so it should not be used to check for
tfile->tx_array.

Use the same logic as in tun_attach(), just test !tfile->deatched.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Fixes: 1576d9860599 ("tun: switch to use skb array for tx")
Cc: Jason Wang <jasowang@redhat.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
 drivers/net/tun.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

On 2018年01月10日 08:07, Cong Wang wrote:
> tfile->tun could be detached before we close the tun fd,
> via tun_detach_all(), so it should not be used to check for
> tfile->tx_array.
>
> Use the same logic as in tun_attach(), just test !tfile->deatched.
>
> Reported-by: Dmitry Vyukov <dvyukov@google.com>
> Fixes: 1576d9860599 ("tun: switch to use skb array for tx")
> Cc: Jason Wang <jasowang@redhat.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
> ---
>   drivers/net/tun.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/tun.c b/drivers/net/tun.c
> index 4f4a842a1c9c..1a1f834440a6 100644
> --- a/drivers/net/tun.c
> +++ b/drivers/net/tun.c
> @@ -613,6 +613,7 @@ static void tun_queue_purge(struct tun_file *tfile)
>   
>   static void __tun_detach(struct tun_file *tfile, bool clean)
>   {
> +	bool clean_tx_array = !tfile->detached;
>   	struct tun_file *ntfile;
>   	struct tun_struct *tun;
>   
> @@ -657,7 +658,7 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
>   			    tun->dev->reg_state == NETREG_REGISTERED)
>   				unregister_netdevice(tun->dev);
>   		}
> -		if (tun)
> +		if (clean_tx_array)
>   			skb_array_cleanup(&tfile->tx_array);
>   		sock_put(&tfile->sk);
>   	}

Looks like we may still leak if we do

open
attach
detach
close

Should we do cleanup unconditionally?

Thanks

On Tue, Jan 9, 2018 at 7:00 PM, Jason Wang <jasowang@redhat.com> wrote:
>
>
> On 2018年01月10日 08:07, Cong Wang wrote:
>>
>> tfile->tun could be detached before we close the tun fd,
>> via tun_detach_all(), so it should not be used to check for
>> tfile->tx_array.
>>
>> Use the same logic as in tun_attach(), just test !tfile->deatched.
>>
>> Reported-by: Dmitry Vyukov <dvyukov@google.com>
>> Fixes: 1576d9860599 ("tun: switch to use skb array for tx")
>> Cc: Jason Wang <jasowang@redhat.com>
>> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
>> ---
>>   drivers/net/tun.c | 3 ++-
>>   1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/net/tun.c b/drivers/net/tun.c
>> index 4f4a842a1c9c..1a1f834440a6 100644
>> --- a/drivers/net/tun.c
>> +++ b/drivers/net/tun.c
>> @@ -613,6 +613,7 @@ static void tun_queue_purge(struct tun_file *tfile)
>>     static void __tun_detach(struct tun_file *tfile, bool clean)
>>   {
>> +       bool clean_tx_array = !tfile->detached;
>>         struct tun_file *ntfile;
>>         struct tun_struct *tun;
>>   @@ -657,7 +658,7 @@ static void __tun_detach(struct tun_file *tfile,
>> bool clean)
>>                             tun->dev->reg_state == NETREG_REGISTERED)
>>                                 unregister_netdevice(tun->dev);
>>                 }
>> -               if (tun)
>> +               if (clean_tx_array)
>>                         skb_array_cleanup(&tfile->tx_array);
>>                 sock_put(&tfile->sk);
>>         }
>
>
> Looks like we may still leak if we do
>
> open
> attach
> detach
> close

Good catch.


>
> Should we do cleanup unconditionally?

It doesn't look like we can, because tfile is not zero'ed at
least, it is allocated by sk_alloc() so tfile->tx_array could be
some random value which prevents skb_array_cleanup()
functioning correctly. Zero'ing tfile->tx_array in open()
is not sufficient, as spinlocks are not yet initialized.

I think we probably need to test tfile->tx_array.ring.queue,
it is ugly but I don't see there is an API for it.