Revert "tuntap: synchronize through tfiles instead of numqueues"

hulk inclusion
category: bugfix
bugzilla: 13267
CVE: NA

-------------------------------------------------

This reverts commit f21e16fe09f32e389c66b9a83c7e47dd1e3e6ce6.

Sync code with mainline
Signed-off-by: NYueHaibing <yuehaibing@huawei.com>
Reviewed-by: NMao Wenan <maowenan@huawei.com>
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>

drivers/net/tun.c

@@ -702,7 +702,6 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
 		rcu_assign_pointer(tun->tfiles[index],
 				   tun->tfiles[tun->numqueues - 1]);
 		ntfile = rtnl_dereference(tun->tfiles[index]);
-		rcu_assign_pointer(tun->tfiles[tun->numqueues - 1], NULL);
 		ntfile->queue_index = index;
 
 		--tun->numqueues;
@@ -1086,7 +1085,7 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
 	tfile = rcu_dereference(tun->tfiles[txq]);
 
 	/* Drop packet if interface is not attached */
-	if (!tfile)
+	if (txq >= tun->numqueues)
 		goto drop;
 
 	if (!rcu_dereference(tun->steering_prog))
@@ -1267,6 +1266,7 @@ static int tun_xdp_xmit(struct net_device *dev, int n,
 {
 	struct tun_struct *tun = netdev_priv(dev);
 	struct tun_file *tfile;
+	u32 numqueues;
 	int drops = 0;
 	int cnt = n;
 	int i;
@@ -1276,13 +1276,15 @@ static int tun_xdp_xmit(struct net_device *dev, int n,
 
 	rcu_read_lock();
 
-	tfile = rcu_dereference(tun->tfiles[smp_processor_id() %
-					    tun->numqueues]);
-	if (!tfile) {
+	numqueues = READ_ONCE(tun->numqueues);
+	if (!numqueues) {
 		rcu_read_unlock();
 		return -ENXIO; /* Caller will free/return all frames */
 	}
 
+	tfile = rcu_dereference(tun->tfiles[smp_processor_id() %
+					    numqueues]);
+
 	spin_lock(&tfile->tx_ring.producer_lock);
 	for (i = 0; i < n; i++) {
 		struct xdp_frame *xdp = frames[i];