Re: [PATCH net] tap: free page on error paths in tap_get_user_xdp()

[Willem de Bruijn]

Weiming Shi wrote:
> tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL,
> and returns -ENOMEM when build_skb() fails. Both paths jump to the err
> label without freeing the page that vhost_net_build_xdp() allocated for
> the frame. tap_sendmsg() discards the per-buffer return value and always
> returns 0, so vhost_tx_batch() takes the success path and never frees
> the page; each rejected frame in a batch leaks one page-frag chunk.
> 
> Free the page on both error paths, before the skb is built. This is the
> tap counterpart of the same leak in tun_xdp_one().
> 
> Fixes: 0efac27791ee ("tap: accept an array of XDP buffs through sendmsg()")
> Fixes: ed7f2afdd0e0 ("tap: add missing verification for short frame")
> Reported-by: Xiang Mei <xmei5@xxxxxxx>
> Assisted-by: Claude:claude-opus-4-7
> Signed-off-by: Weiming Shi <bestswngs@xxxxxxxxx>

Reviewed-by: Willem de Bruijn <willemb@xxxxxxxxxx>