diff options
| author | Xiao Liang <shaw.leon@gmail.com> | 2026-10-27 18:18:27 +0800 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-10-29 09:25:58 -0700 |
| commit | 8f44631ba02afe9fff2f0a0fb66560ab19df87fd (patch) | |
| tree | 33b7d15555ef3aadfb8e856bb4785781289fcab3 | |
| parent | 5bc3aaaa2d1cd1f8988ee1dceffaa8831a30c832 (diff) | |
| download | linux-8f44631ba02afe9fff2f0a0fb66560ab19df87fd.tar.gz linux-8f44631ba02afe9fff2f0a0fb66560ab19df87fd.zip | |
tun: drop batched packets while the device is down
tun_sendmsg() handles TUN_MSG_PTR batches from vhost-net by calling
tun_xdp_one() instead of tun_get_user(). But this path does not check
IFF_UP, allowing packets from a guest to be injected into the host
receive path while the device is administratively down.
Check IFF_UP in tun_xdp_one() before running XDP or building an skb.
Drop the packet when the device is down, matching tun_get_user().
Fixes: 043d222f93ab ("tuntap: accept an array of XDP buffs through sendmsg()")
Signed-off-by: Xiao Liang <shaw.leon@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20261027101830.85327-1-shaw.leon@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | drivers/net/tun.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 770b8fe085c3..dcec7311e601 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -2555,6 +2555,12 @@ static int tun_xdp_one(struct tun_struct *tun, return -EINVAL; } + if (unlikely(!(READ_ONCE(tun->dev->flags) & IFF_UP))) { + put_page(virt_to_head_page(xdp->data)); + dev_core_stats_rx_dropped_inc(tun->dev); + return -EIO; + } + xdp_prog = rcu_dereference(tun->xdp_prog); if (xdp_prog) { if (gso->gso_type) { |