github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

tun: drop batched packets while the device is down

Browse Source 
tun_sendmsg() handles TUN_MSG_PTR batches from vhost-net by calling
tun_xdp_one() instead of tun_get_user(). But this path does not check
IFF_UP, allowing packets from a guest to be injected into the host
receive path while the device is administratively down.

Check IFF_UP in tun_xdp_one() before running XDP or building an skb.
Drop the packet when the device is down, matching tun_get_user().

Fixes: 043d222f93 ("tuntap: accept an array of XDP buffs through sendmsg()")
Signed-off-by: Xiao Liang <shaw.leon@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20261027101830.85327-1-shaw.leon@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Xiao Liang 2026-10-27 18:18:27 +08:00 committed by Jakub Kicinski
parent 5bc3aaaa2d
commit 8f44631ba0
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/net/tun.c
View File

@ -2555,6 +2555,12 @@ static int tun_xdp_one(struct tun_struct *tun,
return -EINVAL;
}
if (unlikely(!(READ_ONCE(tun->dev->flags) & IFF_UP))) {
put_page(virt_to_head_page(xdp->data));
dev_core_stats_rx_dropped_inc(tun->dev);
return -EIO;
}
xdp_prog = rcu_dereference(tun->xdp_prog);
if (xdp_prog) {
if (gso->gso_type) {