On 5/8/26 17:10, Simon Schippers wrote:
> +static void tun_queue_purge(struct tun_struct *tun, struct tun_file *tfile)
> {
> void *ptr;
>
> - while ((ptr = ptr_ring_consume(&tfile->tx_ring)) != NULL)
> + while ((ptr = tun_ring_consume(tun, tfile)) != NULL)
> tun_ptr_free(ptr);
>
> skb_queue_purge(&tfile->sk.sk_write_queue);
Sashiko is right once again. tun_ring_consume() in tun_queue_purge()
operates on a tfile that is being torn down. Its queue_index is no
longer valid. After the swap in __tun_detach(), it points to the
netdev subqueue of a different tfile.
--> We should not wake there.
I will swap tun_ring_consume() with ptr_ring_consume() again and
submit a v12 :)
