[PATCH net v5 0/2] tun: bound the NAPI receive queue

[Antonio Quartulli <antonio@mandelbit.com>]

With IFF_NAPI, tun queues written packets for NAPI on an unbounded
list, which an unprivileged user can grow until the system runs out of
memory. Patch 1 bounds it by netdev_max_backlog; patch 2 adds a
kselftest for the vhost-net paths into that queue.

v5:
- Take at most budget packets in the NAPI poll instead of keeping the
  leftovers on a separate queue (Willem)
- Keep only the lockless check, before allocating, also in
  tun_xdp_one() (Willem)
- Say that an OOM is still possible with large packets and many queues,
  if hard to reach in practice (Sashiko)
- selftest: little-endian ring, buffers returned in any order, lower
  netdev_max_backlog only after setup and restore it first, any non-zero
  experimental_zcopytx, .gitignore entry (Sashiko)
- Rebase on net, which conflicted in selftests/net/config

v4: https://lore.kernel.org/netdev/20261103142232.1869185-1-antonio@mandelbit.com/
- Keep the poll's leftovers on a separate queue, like process_backlog():
  v3 did not bound the queue when the poll ran on another CPU (Sashiko)
- Schedule NAPI when dropping: with netdev_max_backlog below
  NAPI_POLL_WEIGHT, MSG_MORE senders (vhost-net) stalled the queue
  (Sashiko)
- Use goto free_skb for the locked drop (Willem)
- Add a vhost-net kselftest (patch 2); the tun kselftest passes (Willem)
- Cc vhost, kselftest and XDP maintainers and the Fixes author/acker

v3: https://lore.kernel.org/netdev/20261031231444.1528758-1-antonio@mandelbit.com/
- Also bound the sendmsg() paths, which share the queue: zerocopy
  buffers are completed when dropped early, and the batched XDP buffers
  of tun_xdp_one() are covered too (Willem)
- Drop the IFF_NAPI_FRAGS exclusion (Willem)
- Recheck under the queue lock before queueing (Willem)
- Compare with > like enqueue_to_backlog() (Willem)
- Keep the includes sorted (Willem)
- Add the reproducer and a testing statement to the commit message

v2: https://lore.kernel.org/netdev/20261030152540.1409884-1-antonio@mandelbit.com/
- Cc netdev and the maintainers

Testing, in an x86-64 VM with 1 and 2 vCPUs, on net ead744fd1ce0:
- Reproducer from patch 1, 15 seconds, 500 and 3000 iptables rules,
  1400 to 65000-byte packets: memory use stays flat, no OOM; forwarding
  rate unchanged (152577 packets in 3 s without the patch, 151277 with
  it).
- tun_vhost (patch 2), with vhost_net experimental_zcopytx=0 and =1:
  passes with patch 1. Without it, every variant fails (nothing is
  dropped); removing the tun_xdp_one() check fails the batch variant,
  removing the zerocopy completion fails the zerocopy one, and removing
  the NAPI scheduling on drop fails the copy and zerocopy ones.
- tun kselftest: pass:91 fail:0 xfail:12, as without the patch.

Notes:
- Affected since 943170998b20 (v4.15).
- Mitigation: disallow unprivileged user namespaces or restrict
  access to /dev/net/tun.

Antonio Quartulli (2):
  tun: bound the NAPI receive queue
  selftests: net: add a vhost-net test for the tun NAPI queue bound

 drivers/net/tun.c                       |  59 +++-
 tools/testing/selftests/net/.gitignore  |   1 +
 tools/testing/selftests/net/Makefile    |   1 +
 tools/testing/selftests/net/config      |   1 +
 tools/testing/selftests/net/tun_vhost.c | 409 ++++++++++++++++++++++++
 5 files changed, 463 insertions(+), 8 deletions(-)
 create mode 100644 tools/testing/selftests/net/tun_vhost.c

-- 
2.56.0