On 2019/5/7 下午12:54, Cong Wang wrote:
On Mon, May 6, 2019 at 9:03 PM Jason Wang <jasow...@redhat.com> wrote:diff --git a/drivers/net/tun.c b/drivers/net/tun.c index e9ca1c0..32a0b23 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -700,6 +700,8 @@ static void __tun_detach(struct tun_file *tfile, bool clean) tun->tfiles[tun->numqueues - 1]); ntfile = rtnl_dereference(tun->tfiles[index]); ntfile->queue_index = index; + rcu_assign_pointer(tun->tfiles[tun->numqueues - 1], + NULL);How does this work? Existing readers could still read this tun->tfiles[tun->numqueues - 1] before you NULL it. And, _if_ the following sock_put() is the one frees it, you still miss a RCU grace period. if (clean) { RCU_INIT_POINTER(tfile->tun, NULL); sock_put(&tfile->sk); Thanks.
My understanding is the socket will never be freed for this sock_put(). We just drop an extra reference count we held when the socket was attached to the netdevice (there's a sock_hold() in tun_attach()). The real free should happen at another sock_put() in the end of this function.
Thanks
