[PATCH net] tun: free page on build_skb failure in tun_xdp_one()

[PATCH net] tun: free page on build_skb failure in tun_xdp_one()

[Weiming Shi]

When build_skb() fails in tun_xdp_one(), the function sets ret to
-ENOMEM and jumps to the out label, which returns without freeing the
page that vhost_net_build_xdp() allocated for the frame. As with the
short-frame rejection path, tun_sendmsg() discards the per-buffer error
and still returns total_len, so vhost_tx_batch() takes the success path
and never frees the page. Each build_skb() failure in a batch leaks one
page-frag chunk.

Free the page before taking the error path, matching the put_page() the
other error exits of tun_xdp_one() already perform.

Fixes: 043d222f93ab ("tuntap: accept an array of XDP buffs through sendmsg()")
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
 drivers/net/tun.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index b183189f1853..39e9f3390c91 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -2437,6 +2437,7 @@ static int tun_xdp_one(struct tun_struct *tun,
 build:
 	skb = build_skb(xdp->data_hard_start, buflen);
 	if (!skb) {
+		put_page(virt_to_head_page(xdp->data));
 		ret = -ENOMEM;
 		goto out;
 	}
-- 
2.43.0

Re: [PATCH net] tun: free page on build_skb failure in tun_xdp_one()

[Dongli Zhang]

On 2026-05-21 9:33 AM, Weiming Shi wrote:
> When build_skb() fails in tun_xdp_one(), the function sets ret to
> -ENOMEM and jumps to the out label, which returns without freeing the
> page that vhost_net_build_xdp() allocated for the frame. As with the
> short-frame rejection path, tun_sendmsg() discards the per-buffer error
> and still returns total_len, so vhost_tx_batch() takes the success path
> and never frees the page. Each build_skb() failure in a batch leaks one
> page-frag chunk.
> 
> Free the page before taking the error path, matching the put_page() the
> other error exits of tun_xdp_one() already perform.
> 
> Fixes: 043d222f93ab ("tuntap: accept an array of XDP buffs through sendmsg()")
> Reported-by: Xiang Mei <xmei5@asu.edu>
> Assisted-by: Claude:claude-opus-4-7
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> ---
>  drivers/net/tun.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/tun.c b/drivers/net/tun.c
> index b183189f1853..39e9f3390c91 100644
> --- a/drivers/net/tun.c
> +++ b/drivers/net/tun.c
> @@ -2437,6 +2437,7 @@ static int tun_xdp_one(struct tun_struct *tun,
>  build:
>  	skb = build_skb(xdp->data_hard_start, buflen);
>  	if (!skb) {
> +		put_page(virt_to_head_page(xdp->data));
>  		ret = -ENOMEM;
>  		goto out;
>  	}

The bug fix applies to both TAP and TUN.

TAP has a single patch, while TUN has two separate patches. I'm not sure which
approach is better.

[PATCH net] tap: free page on error paths in tap_get_user_xdp()
https://lore.kernel.org/netdev/20260521163230.1478627-2-bestswngs@gmail.com

[PATCH net] tun: free page on short-frame rejection in tun_xdp_one()
https://lore.kernel.org/all/20260520160020.375349-2-bestswngs@gmail.com

[PATCH net] tun: free page on build_skb failure in tun_xdp_one()
https://lore.kernel.org/netdev/20260521163312.1479805-2-bestswngs@gmail.com/


The bug fix looks good to me.

Reviewed-by: Dongli Zhang <dongli.zhang@oracle.com>

+ Michael and Si-Wei for FYI regarding vhost as well.

Thank you very much!

Dongli Zhang

Re: [PATCH net] tun: free page on build_skb failure in tun_xdp_one()

[Willem de Bruijn]

Weiming Shi wrote:
> When build_skb() fails in tun_xdp_one(), the function sets ret to
> -ENOMEM and jumps to the out label, which returns without freeing the
> page that vhost_net_build_xdp() allocated for the frame. As with the
> short-frame rejection path, tun_sendmsg() discards the per-buffer error
> and still returns total_len, so vhost_tx_batch() takes the success path
> and never frees the page. Each build_skb() failure in a batch leaks one
> page-frag chunk.
> 
> Free the page before taking the error path, matching the put_page() the
> other error exits of tun_xdp_one() already perform.
> 
> Fixes: 043d222f93ab ("tuntap: accept an array of XDP buffs through sendmsg()")
> Reported-by: Xiang Mei <xmei5@asu.edu>
> Assisted-by: Claude:claude-opus-4-7
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>

Reviewed-by: Willem de Bruijn <willemb@google.com>

Re: [PATCH net] tun: free page on build_skb failure in tun_xdp_one()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 21 May 2026 09:33:13 -0700 you wrote:
> When build_skb() fails in tun_xdp_one(), the function sets ret to
> -ENOMEM and jumps to the out label, which returns without freeing the
> page that vhost_net_build_xdp() allocated for the frame. As with the
> short-frame rejection path, tun_sendmsg() discards the per-buffer error
> and still returns total_len, so vhost_tx_batch() takes the success path
> and never frees the page. Each build_skb() failure in a batch leaks one
> page-frag chunk.
> 
> [...]

Here is the summary with links:
  - [net] tun: free page on build_skb failure in tun_xdp_one()
    https://git.kernel.org/netdev/net/c/aa8963fdce66

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html