With IFF_NAPI, tun queues written packets for NAPI on an unbounded list, which an unprivileged user can grow until the system runs out of memory. Patch 1 bounds it by netdev_max_backlog; patch 2 adds a kselftest for the vhost-net paths into that queue.
v4: - Keep the poll's leftovers on a separate queue, like process_backlog(): v3 did not bound the queue when the poll ran on another CPU (Sashiko) - Schedule NAPI when dropping: with netdev_max_backlog below NAPI_POLL_WEIGHT, MSG_MORE senders (vhost-net) stalled the queue (Sashiko) - Use goto free_skb for the locked drop (Willem) - Add a vhost-net kselftest (patch 2); the tun kselftest passes (Willem) - Cc vhost, kselftest and XDP maintainers and the Fixes author/acker v3: https://lore.kernel.org/netdev/[email protected]/ - Also bound the sendmsg() paths, which share the queue: zerocopy buffers are completed when dropped early, and the batched XDP buffers of tun_xdp_one() are covered too (Willem) - Drop the IFF_NAPI_FRAGS exclusion (Willem) - Recheck under the queue lock before queueing (Willem) - Compare with > like enqueue_to_backlog() (Willem) - Keep the includes sorted (Willem) - Add the reproducer and a testing statement to the commit message v2: https://lore.kernel.org/netdev/[email protected]/ - Cc netdev and the maintainers Testing, in an x86-64 VM with 1 and 2 vCPUs: - Reproducer from patch 1, 15 seconds, 500 and 3000 iptables rules: memory use stays flat, no OOM; forwarding rate unchanged (112962 packets in 3 s without the patch, 113822 with it). - tun_vhost (patch 2), with vhost_net experimental_zcopytx=0 and =1: passes with patch 1. Without it, every variant fails (nothing is dropped); removing the tun_xdp_one() check fails the batch variant, and removing the zerocopy completion fails the zerocopy one. - tun kselftest: pass:91 fail:0 xfail:12, as without the patch. Notes: - Affected since 943170998b20 (v4.15). Based on net/main 94cea342e891. - Mitigation: disallow unprivileged user namespaces or restrict access to /dev/net/tun. Antonio Quartulli (2): tun: bound the NAPI receive queue selftests: net: add a vhost-net test for the tun NAPI queue bound drivers/net/tun.c | 82 +++++- tools/testing/selftests/net/Makefile | 1 + tools/testing/selftests/net/config | 1 + tools/testing/selftests/net/tun_vhost.c | 361 ++++++++++++++++++++++++ 4 files changed, 431 insertions(+), 14 deletions(-) create mode 100644 tools/testing/selftests/net/tun_vhost.c -- 2.56.0
