Commit 8f44631ba02a for kernel

commit 8f44631ba02afe9fff2f0a0fb66560ab19df87fd
Author: Xiao Liang <shaw.leon@gmail.com>
Date:   Tue Oct 27 18:18:27 2026 +0800

    tun: drop batched packets while the device is down

    tun_sendmsg() handles TUN_MSG_PTR batches from vhost-net by calling
    tun_xdp_one() instead of tun_get_user(). But this path does not check
    IFF_UP, allowing packets from a guest to be injected into the host
    receive path while the device is administratively down.

    Check IFF_UP in tun_xdp_one() before running XDP or building an skb.
    Drop the packet when the device is down, matching tun_get_user().

    Fixes: 043d222f93ab ("tuntap: accept an array of XDP buffs through sendmsg()")
    Signed-off-by: Xiao Liang <shaw.leon@gmail.com>
    Reviewed-by: Willem de Bruijn <willemb@google.com>
    Link: https://patch.msgid.link/20261027101830.85327-1-shaw.leon@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 770b8fe085c3..dcec7311e601 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -2555,6 +2555,12 @@ static int tun_xdp_one(struct tun_struct *tun,
 		return -EINVAL;
 	}

+	if (unlikely(!(READ_ONCE(tun->dev->flags) & IFF_UP))) {
+		put_page(virt_to_head_page(xdp->data));
+		dev_core_stats_rx_dropped_inc(tun->dev);
+		return -EIO;
+	}
+
 	xdp_prog = rcu_dereference(tun->xdp_prog);
 	if (xdp_prog) {
 		if (gso->gso_type) {