From nobody Sun May 24 20:33:36 2026 Received: from mail-dy1-f177.google.com (mail-dy1-f177.google.com [74.125.82.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2D81A371895 for ; Thu, 21 May 2026 16:33:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779381187; cv=none; b=eFeswdty1w48AuOdnAlghSDzNGcwWJ0/VvhDkz1VnS7z1/Y4nyVEsdZgpSNeuPFKSin0KreQASk29JpPkeae+EzZU0a3ytcxRfb9/dygFmdRXg6PPstrfd/v2MwJ69KTjbWhYkBs+VeEdtMl++IybHUA/SL8PV+CFBXGSSw9Gw4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779381187; c=relaxed/simple; bh=wzqew7g6CT9dlDsf+TrWejqdUCW50+VVAcpXKutM9V8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Kap0s7dZ9OMdNA8o2ltjVv8+5hzvgW/YEWKUyq+ruQhmaXznbbDdL8j8NUIbYFOuDBAKtwRsMteHu2oP/2jj2CIq+jqsIFtCrU0k1cm15K5OFVpZDDsoGVMDOPNIcrsKj+sAbk6VoVLSaLhJTT93Ul4VBXUATs6guxMkkWv9Ip0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ipsbWf5E; arc=none smtp.client-ip=74.125.82.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ipsbWf5E" Received: by mail-dy1-f177.google.com with SMTP id 5a478bee46e88-2ef8d6ba48bso3360699eec.1 for ; Thu, 21 May 2026 09:33:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779381185; x=1779985985; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=5R98YEASOuZ8Uxpfr/WLsgAsOAjnGS8bXv+DgQs1RHY=; b=ipsbWf5EwJgJ2zEPKqfDA3X4GbhGgl3PNhpdCMzSc+dfjXKLbkJlPQu+nHEdmf9d/9 F7KHGjN6ubSqxQ/uawRM8bgf1ht5ur5HlS2mreyrpT01d5oU1cvv+5+/QoNwI6JlHTUj 2DjSdpkmxAlyN1dQRG5i3ADuD20c13gRFIPgQkF0aADBwLUg3clecZP1l+/1MuITAjE9 o0oWE/7IKoPtA4P5iyg2t+ePRP7AZ096IdpfMNyGufYFeuI9pT1d8nUg+OdhYmh28/Qn 2OxuvhItqMXys4v22cax9d4whdB1V2ZUEBHOr83qbZbj2LsFAMZjqF6YHXQcDS+LlMlp AA7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779381185; x=1779985985; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=5R98YEASOuZ8Uxpfr/WLsgAsOAjnGS8bXv+DgQs1RHY=; b=RWlEvHMO5fP+Ta8mL+s+98aci3BEmZKUsPI83bwdufvffHSfsTrvCInSr9wK/wuuB9 OMuPvU6y9n+5mRSE6udCIfuQl03gpE6bnWOehPyvwt50hBxmG2pMHI/AKOvAhdqNygCO I76qVr3OsIHMy0KWrPZrd0AAZLiO8iUZ7Gmv5SVRMn76V3aME1Eozq2fTIgc8qlzh8In kzILLP4Avm3dcV4uEnKLoZHV+RxmXx+YpWBhovlbD6vrXjgAiF1PmJI9Y+vSWQWeEWtT F1PMnAJR0h0PJl0tzMkrYJRHPKJg85by9KUm/dj5YcVFhrYOyzq8TVD9aTROC8sCg+8L EOXg== X-Forwarded-Encrypted: i=1; AFNElJ/t9nweVvHViwYGQGD4iPngWpzZi3adAid5IEjKNGosRfIixewsnDi8Zn9ybdZM+y3bFcDnL+MOmvWDy0w=@vger.kernel.org X-Gm-Message-State: AOJu0YyaZSuVEgg8ib70lveyBNpP6Ub++l+WTx3ikKfddEzg89EPV9ZO I5/Fro/o2vrnipEjZ1dPZarmG/6ZLgFUYQa5FGIzmczqvt/MHl8GJi8anJourrhJ8xE= X-Gm-Gg: Acq92OFzGXce7e/26mJd3OBRa6DTIn9LmMdw0VspTGr2LCHAoeqV7ij4yJ4YSGpgWLe Kt1y6ENjMdNsCi/vRJFf4eHZPM7+k7ZPJfQFKnUDnwM/NwuwtWilkWUCnbjPdA/VxBREIccz+Zt nci1VlYTnxJb8Ll9UnEQalajdmpPoMhUjQq+e9V5PLVqvTOMdgyLwRFrODFYrXbAbSwG7KgvScY OgUDb25V21n54cEg1UBJb7M8hmWAP0uT9mfwjdZkdyjtLbx00jgK2qQJ+ekLa3RUmRIJkemdJj3 z9zTOl3fG9xpHVdlg1Wlrpk+Bx/h18C6gy7fk9GbWhueeStrYmT3k4y7TkzIH9swCWJkwuP/SIG 0/3XrSosXK41TL0pRN6yHzH1DYWoejFVFQRKj8oJcYT12E2eal3MAGu9E03ifJZuUIXdDINiSl0 H/BMYBF6T+sb5w4PHU9U11bgT+t0w8jrIT0BqAqgQX6HmpvMSgQuXPv++O1V4ayO/BhiO8 X-Received: by 2002:a05:7300:7c16:b0:2d3:9c91:6c45 with SMTP id 5a478bee46e88-3043203edeamr1945367eec.6.1779381184998; Thu, 21 May 2026 09:33:04 -0700 (PDT) Received: from fx.tailc0aff1.ts.net ([206.206.192.132]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3044330cd9csm834851eec.11.2026.05.21.09.33.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 21 May 2026 09:33:04 -0700 (PDT) From: Weiming Shi To: netdev@vger.kernel.org Cc: willemdebruijn.kernel@gmail.com, jasowang@redhat.com, pabeni@redhat.com, kuba@kernel.org, edumazet@google.com, dongli.zhang@oracle.com, xmei5@asu.edu, linux-kernel@vger.kernel.org, Weiming Shi Subject: [PATCH net] tap: free page on error paths in tap_get_user_xdp() Date: Thu, 21 May 2026 09:32:31 -0700 Message-ID: <20260521163230.1478627-2-bestswngs@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the err label without freeing the page that vhost_net_build_xdp() allocated for the frame. tap_sendmsg() discards the per-buffer return value and always returns 0, so vhost_tx_batch() takes the success path and never frees the page; each rejected frame in a batch leaks one page-frag chunk. Free the page on both error paths, before the skb is built. This is the tap counterpart of the same leak in tun_xdp_one(). Fixes: 0efac27791ee ("tap: accept an array of XDP buffs through sendmsg()") Fixes: ed7f2afdd0e0 ("tap: add missing verification for short frame") Reported-by: Xiang Mei Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Weiming Shi Reviewed-by: Dongli Zhang --- drivers/net/tap.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/tap.c b/drivers/net/tap.c index b8240737dc51..2e75846d1072 100644 --- a/drivers/net/tap.c +++ b/drivers/net/tap.c @@ -1052,6 +1052,7 @@ static int tap_get_user_xdp(struct tap_queue *q, stru= ct xdp_buff *xdp) int err, depth; =20 if (unlikely(xdp->data_end - xdp->data < ETH_HLEN)) { + put_page(virt_to_head_page(xdp->data)); err =3D -EINVAL; goto err; } @@ -1061,6 +1062,7 @@ static int tap_get_user_xdp(struct tap_queue *q, stru= ct xdp_buff *xdp) =20 skb =3D build_skb(xdp->data_hard_start, buflen); if (!skb) { + put_page(virt_to_head_page(xdp->data)); err =3D -ENOMEM; goto err; } --=20 2.43.0