From 28eef87694a50e86cd868b1e13580480bd9e8450 Mon Sep 17 00:00:00 2001 From: Jiale Yao Date: Sat, 3 Oct 2026 17:38:21 +0800 Subject: [PATCH] tun: Drain eBPF RCU callbacks on module exit Replacing or clearing a TUN eBPF program defers its destruction to tun_prog_free(). In the device teardown path, tun_free_netdev() can queue this callback as a private destructor. The rcu_barrier() in netdev_run_todo() runs before private destructors, so it cannot drain the new callback. After the last file or persistent-device reference is released, tun can therefore unload before the callback runs. Drain outstanding callbacks at the end of module cleanup so they cannot execute from freed module text. These issues were found by a static analysis method. Cc: stable+noautosel@kernel.org # needs real net-admin (non-ns) Fixes: 96f84061620c ("tun: add eBPF based queue selection method") Signed-off-by: Jiale Yao Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20261003093822.544964-1-yaojiale02@163.com Signed-off-by: Jakub Kicinski --- drivers/net/tun.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 5a302709a68a..bde5032bf4f4 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -3855,6 +3855,7 @@ static void __exit tun_cleanup(void) misc_deregister(&tun_miscdev); rtnl_link_unregister(&tun_link_ops); unregister_netdevice_notifier(&tun_notifier_block); + rcu_barrier(); } /* Get an underlying socket object from tun file. Returns error unless file is