With IFF_NAPI, tun queues written packets for NAPI on an unbounded
list, which an unprivileged user can grow until the system runs out of
memory. Patch 1 bounds it by netdev_max_backlog; patch 2 adds a
kselftest for the vhost-net paths into that queue.
v4:
- Keep the poll's leftovers on a separate queue, like process_backlog():
v3 did not bound the queue when the poll ran on another CPU (Sashiko)
- Schedule NAPI when dropping: with netdev_max_backlog below
NAPI_POLL_WEIGHT, MSG_MORE senders (vhost-net) stalled the queue
(Sashiko)
- Use goto free_skb for the locked drop (Willem)
- Add a vhost-net kselftest (patch 2); the tun kselftest passes (Willem)
- Cc vhost, kselftest and XDP maintainers and the Fixes author/acker
v3: https://lore.kernel.org/netdev/20261031231444.1528758-1-antonio@mandelbit.com/ (local)
- Also bound the sendmsg() paths, which share the queue: zerocopy
buffers are completed when dropped early, and the batched XDP buffers
of tun_xdp_one() are covered too (Willem)
- Drop the IFF_NAPI_FRAGS exclusion (Willem)
- Recheck under the queue lock before queueing (Willem)
- Compare with > like enqueue_to_backlog() (Willem)
- Keep the includes sorted (Willem)
- Add the reproducer and a testing statement to the commit message
v2: https://lore.kernel.org/netdev/20261030152540.1409884-1-antonio@mandelbit.com/ (local)
- Cc netdev and the maintainers
Testing, in an x86-64 VM with 1 and 2 vCPUs:
- Reproducer from patch 1, 15 seconds, 500 and 3000 iptables rules:
memory use stays flat, no OOM; forwarding rate unchanged (112962
packets in 3 s without the patch, 113822 with it).
- tun_vhost (patch 2), with vhost_net experimental_zcopytx=0 and =1:
passes with patch 1. Without it, every variant fails (nothing is
dropped); removing the tun_xdp_one() check fails the batch variant,
and removing the zerocopy completion fails the zerocopy one.
- tun kselftest: pass:91 fail:0 xfail:12, as without the patch.
Notes:
- Affected since 943170998b20 (v4.15). Based on net/main 94cea342e891.
- Mitigation: disallow unprivileged user namespaces or restrict
access to /dev/net/tun.
Antonio Quartulli (2):
tun: bound the NAPI receive queue
selftests: net: add a vhost-net test for the tun NAPI queue bound
drivers/net/tun.c | 82 +++++-
tools/testing/selftests/net/Makefile | 1 +
tools/testing/selftests/net/config | 1 +
tools/testing/selftests/net/tun_vhost.c | 361 ++++++++++++++++++++++++
4 files changed, 431 insertions(+), 14 deletions(-)
create mode 100644 tools/testing/selftests/net/tun_vhost.c
--
2.56.0