tun: fix rcu_read_lock imbalance in tun_build_skb

[ Upstream commit 654d573845f35017dc397840fa03610fef3d08b0 ]

rcu_read_lock in tun_build_skb is used to rcu_dereference tun->xdp_prog
safely, rcu_read_unlock should be done in every return path.

Now I could see one place missing it, where it returns NULL in switch-case
XDP_REDIRECT,  another palce using rcu_read_lock wrongly, where it returns
NULL in if (xdp_xmit) chunk.

So fix both in this patch.

Fixes: 761876c857cb ("tap: XDP support")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index a5c47db94846cd919aab7076ee2dcdbb3008676a..d06f88312e1e8ff1c3b701aa34f6e6d3ac7219f8 100644 (file)
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1326,6 +1326,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
                        err = xdp_do_redirect(tun->dev, &xdp, xdp_prog);
                        if (err)
                                goto err_redirect;
+                       rcu_read_unlock();
                        return NULL;
                case XDP_TX:
                        xdp_xmit = true;
@@ -1358,7 +1359,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
        if (xdp_xmit) {
                skb->dev = tun->dev;
                generic_xdp_tx(skb, xdp_prog);
-               rcu_read_lock();
+               rcu_read_unlock();
                return NULL;
        }