tun: mark small packets as owned by the tap sock [Linux 4.19.66]

This Linux kernel change "tun: mark small packets as owned by the tap sock" is included in the Linux 4.19.66 release. This change is authored by Alexis Bauvin <abauvin [at] scaleway.com> on Tue Jul 23 16:23:01 2019 +0200. The commit for this change in Linux stable tree is f378724 (patch) which is from upstream commit 4b66336. The same Linux upstream change may have been applied to various maintained Linux releases and you can find all Linux releases containing changes from upstream 4b66336.

tun: mark small packets as owned by the tap sock

[ Upstream commit 4b663366246be1d1d4b1b8b01245b2e88ad9e706 ]

- v1 -> v2: Move skb_set_owner_w to __tun_build_skb to reduce patch size

Small packets going out of a tap device go through an optimized code
path that uses build_skb() rather than sock_alloc_send_pskb(). The
latter calls skb_set_owner_w(), but the small packet code path does not.

The net effect is that small packets are not owned by the userland
application's socket (e.g. QEMU), while large packets are.
This can be seen with a TCP session, where packets are not owned when
the window size is small enough (around PAGE_SIZE), while they are once
the window grows (note that this requires the host to support virtio
tso for the guest to offload segmentation).
All this leads to inconsistent behaviour in the kernel, especially on
netfilter modules that uses sk->socket (e.g. xt_owner).

Fixes: 66ccbc9c87c2 ("tap: use build_skb() for small packet")
Signed-off-by: Alexis Bauvin <abauvin@scaleway.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

There is one line of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 drivers/net/tun.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index b67fee5..5fa7047 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1682,6 +1682,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,

    skb_reserve(skb, pad - delta);
    skb_put(skb, len);
+   skb_set_owner_w(skb, tfile->socket.sk);
    get_page(alloc_frag->page);
    alloc_frag->offset += buflen;

Leave a Reply

Your email address will not be published. Required fields are marked *