[PATCH net] tap: free page on error paths in tap_get_user_xdp()

[PATCH net] tap: free page on error paths in tap_get_user_xdp()

[Weiming Shi]

tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL,
and returns -ENOMEM when build_skb() fails. Both paths jump to the err
label without freeing the page that vhost_net_build_xdp() allocated for
the frame. tap_sendmsg() discards the per-buffer return value and always
returns 0, so vhost_tx_batch() takes the success path and never frees
the page; each rejected frame in a batch leaks one page-frag chunk.

Free the page on both error paths, before the skb is built. This is the
tap counterpart of the same leak in tun_xdp_one().

Fixes: 0efac27791ee ("tap: accept an array of XDP buffs through sendmsg()")
Fixes: ed7f2afdd0e0 ("tap: add missing verification for short frame")
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
 drivers/net/tap.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/tap.c b/drivers/net/tap.c
index b8240737dc51..2e75846d1072 100644
--- a/drivers/net/tap.c
+++ b/drivers/net/tap.c
@@ -1052,6 +1052,7 @@ static int tap_get_user_xdp(struct tap_queue *q, struct xdp_buff *xdp)
 	int err, depth;
 
 	if (unlikely(xdp->data_end - xdp->data < ETH_HLEN)) {
+		put_page(virt_to_head_page(xdp->data));
 		err = -EINVAL;
 		goto err;
 	}
@@ -1061,6 +1062,7 @@ static int tap_get_user_xdp(struct tap_queue *q, struct xdp_buff *xdp)
 
 	skb = build_skb(xdp->data_hard_start, buflen);
 	if (!skb) {
+		put_page(virt_to_head_page(xdp->data));
 		err = -ENOMEM;
 		goto err;
 	}
-- 
2.43.0

Re: [PATCH net] tap: free page on error paths in tap_get_user_xdp()

[Dongli Zhang]

On 2026-05-21 9:32 AM, Weiming Shi wrote:
> tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL,
> and returns -ENOMEM when build_skb() fails. Both paths jump to the err
> label without freeing the page that vhost_net_build_xdp() allocated for
> the frame. tap_sendmsg() discards the per-buffer return value and always
> returns 0, so vhost_tx_batch() takes the success path and never frees
> the page; each rejected frame in a batch leaks one page-frag chunk.
> 
> Free the page on both error paths, before the skb is built. This is the
> tap counterpart of the same leak in tun_xdp_one().
> 
> Fixes: 0efac27791ee ("tap: accept an array of XDP buffs through sendmsg()")
> Fixes: ed7f2afdd0e0 ("tap: add missing verification for short frame")
> Reported-by: Xiang Mei <xmei5@asu.edu>
> Assisted-by: Claude:claude-opus-4-7
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> ---
>  drivers/net/tap.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/tap.c b/drivers/net/tap.c
> index b8240737dc51..2e75846d1072 100644
> --- a/drivers/net/tap.c
> +++ b/drivers/net/tap.c
> @@ -1052,6 +1052,7 @@ static int tap_get_user_xdp(struct tap_queue *q, struct xdp_buff *xdp)
>  	int err, depth;
>  
>  	if (unlikely(xdp->data_end - xdp->data < ETH_HLEN)) {
> +		put_page(virt_to_head_page(xdp->data));
>  		err = -EINVAL;
>  		goto err;
>  	}
> @@ -1061,6 +1062,7 @@ static int tap_get_user_xdp(struct tap_queue *q, struct xdp_buff *xdp)
>  
>  	skb = build_skb(xdp->data_hard_start, buflen);
>  	if (!skb) {
> +		put_page(virt_to_head_page(xdp->data));
>  		err = -ENOMEM;
>  		goto err;
>  	}

The bug fix looks good to me.

Reviewed-by: Dongli Zhang <dongli.zhang@oracle.com>

+ Michael and Si-Wei for FYI regarding vhost as well.

Thank you very much!

Dongli Zhang