From cd152ea2d27f130f30f3d744e27dc398a8c463ee Mon Sep 17 00:00:00 2001 From: Florent Revest Date: Fri, 20 Feb 2026 14:01:26 +0100 Subject: executor: fix up /dev/net/tun before opening it We get various reports like: "SYZFAIL: tun: can't open /dev/net/tun": https://syzkaller.appspot.com/bug?extid=17b76f12c4893fc7b67b or like "SYZFAIL: tun: ioctl(TUNSETIFF) failed" https://syzkaller.appspot.com/bug?extid=49461b4cd5aa62f553fc Which look a lot like syzkaller manages to delete or replace /dev/net/tun and from there on consistently fail to open the device and complains with these SYZFAIL. This is an attempt to fix up the /dev/net/tun before we open it so we know we try to open the right file. --- executor/common_linux.h | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) (limited to 'executor/common_linux.h') diff --git a/executor/common_linux.h b/executor/common_linux.h index 7c4fd9b68..c1368f292 100644 --- a/executor/common_linux.h +++ b/executor/common_linux.h @@ -639,6 +639,7 @@ static struct nlmsg nlmsg; #include #include #include +#include #include #include @@ -665,12 +666,36 @@ static int tun_frags_enabled; #endif #endif +// Sometimes, executors like to delete or replace /dev/net/tun and this causes +// all further executors to fail. Let's make sure it's the right char device. +static void correct_dev_net_tun(void) +{ + struct stat st; + if (stat("/dev/net/tun", &st) == 0) { + if (S_ISCHR(st.st_mode) && major(st.st_rdev) == 10 && minor(st.st_rdev) == 200) + return; + if (unlink("/dev/net/tun")) { + debug("tun: unlink(/dev/net/tun) failed: %d\n", errno); + } + } + if (mkdir("/dev/net", 0755) && errno != EEXIST) { + debug("tun: mkdir(/dev/net) failed: %d\n", errno); + } + if (mknod("/dev/net/tun", S_IFCHR | 0666, makedev(10, 200))) { + debug("tun: mknod(/dev/net/tun) failed: %d\n", errno); + } + if (chmod("/dev/net/tun", 0666)) { + debug("tun: chmod(/dev/net/tun) failed: %d\n", errno); + } +} + static void initialize_tun(void) { #if SYZ_EXECUTOR if (!flag_net_injection) return; #endif + correct_dev_net_tun(); tunfd = open("/dev/net/tun", O_RDWR | O_NONBLOCK); if (tunfd == -1) { #if SYZ_EXECUTOR -- cgit mrf-deployment