Re: [PATCH net] tun: free page on build_skb failure in tun_xdp_one()

[Dongli Zhang]

On 2026-05-21 9:33 AM, Weiming Shi wrote:
> When build_skb() fails in tun_xdp_one(), the function sets ret to
> -ENOMEM and jumps to the out label, which returns without freeing the
> page that vhost_net_build_xdp() allocated for the frame. As with the
> short-frame rejection path, tun_sendmsg() discards the per-buffer error
> and still returns total_len, so vhost_tx_batch() takes the success path
> and never frees the page. Each build_skb() failure in a batch leaks one
> page-frag chunk.
> 
> Free the page before taking the error path, matching the put_page() the
> other error exits of tun_xdp_one() already perform.
> 
> Fixes: 043d222f93ab ("tuntap: accept an array of XDP buffs through sendmsg()")
> Reported-by: Xiang Mei <xmei5@xxxxxxx>
> Assisted-by: Claude:claude-opus-4-7
> Signed-off-by: Weiming Shi <bestswngs@xxxxxxxxx>
> ---
>  drivers/net/tun.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/tun.c b/drivers/net/tun.c
> index b183189f1853..39e9f3390c91 100644
> --- a/drivers/net/tun.c
> +++ b/drivers/net/tun.c
> @@ -2437,6 +2437,7 @@ static int tun_xdp_one(struct tun_struct *tun,
>  build:
>  	skb = build_skb(xdp->data_hard_start, buflen);
>  	if (!skb) {
> +		put_page(virt_to_head_page(xdp->data));
>  		ret = -ENOMEM;
>  		goto out;
>  	}

The bug fix applies to both TAP and TUN.

TAP has a single patch, while TUN has two separate patches. I'm not sure which
approach is better.

[PATCH net] tap: free page on error paths in tap_get_user_xdp()
https://lore.kernel.org/netdev/20260521163230.1478627-2-bestswngs@xxxxxxxxx

[PATCH net] tun: free page on short-frame rejection in tun_xdp_one()
https://lore.kernel.org/all/20260520160020.375349-2-bestswngs@xxxxxxxxx

[PATCH net] tun: free page on build_skb failure in tun_xdp_one()
https://lore.kernel.org/netdev/20260521163312.1479805-2-bestswngs@xxxxxxxxx/


The bug fix looks good to me.

Reviewed-by: Dongli Zhang <dongli.zhang@xxxxxxxxxx>

+ Michael and Si-Wei for FYI regarding vhost as well.

Thank you very much!

Dongli Zhang