• H
    tun: Only free a netdev when all tun descriptors are closed · 9c3fea6a
    Herbert Xu 提交于
    The commit c70f1829 ("tun: Fix
    races between tun_net_close and free_netdev") fixed a race where
    an asynchronous deletion of a tun device can hose a poll(2) on
    a tun fd attached to that device.
    
    However, this came at the cost of moving the tun wait queue into
    the tun file data structure.  The problem with this is that it
    imposes restrictions on when and where the tun device can access
    the wait queue since the tun file may change at any time due to
    detaching and reattaching.
    
    In particular, now that we need to use the wait queue on the
    receive path it becomes difficult to properly synchronise this
    with the detachment of the tun device.
    
    This patch solves the original race in a different way.  Since
    the race is only because the underlying memory gets freed, we
    can prevent it simply by ensuring that we don't do that until
    all tun descriptors ever attached to the device (even if they
    have since be detached because they may still be sitting in poll)
    have been closed.
    
    This is done by using reference counting the attached tun file
    descriptors.  The refcount in tun->sk has been reappropriated
    for this purpose since it was already being used for that, albeit
    from the opposite angle.
    
    Note that we no longer zero tfile->tun since tun_get will return
    NULL anyway after the refcount on tfile hits zero.  Instead it
    represents whether this device has ever been attached to a device.
    Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    9c3fea6a
tun.c 31.6 KB