netdev - [PATCH/RFC] tun: defer skb_orphan() to tun_do

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 5 Mar 2019 21:02:14 +0000
From:   Arthur Kepner <Arthur.Kepner@...erbed.com>
To:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>
CC:     Abhik Sarkar <Abhik.Sarkar@...erbed.com>
Subject: [PATCH/RFC] tun: defer skb_orphan() to tun_do_read()

The attachment contains an UNTESTED patch (though a similar patch was tested with a 
3.10 kernel). 

We've been chasing a bug where packet corruption is seen on a tap device. We have a 
PACKET_MMAP socket which is bound to a tap interface. When throughput goes above a 
threshold, we begin to see that packets received on the tap device are truncated, or 
otherwise corrupted. We found that when packets are enqueued to the tap device, they 
are fine, but by the time they are read, they can be corrupted. 

And we found that simply deferring the call to skb_orphan() (where the destructor, 
tpacket_destruct_skb() marks the frame as TP_STATUS_AVAILABLE) fixes the problem. 

Maybe there's a better fix, but this worked for us. Thoughts? (Please CC me on replies - I'm not 
subscribed.) 

-- 
Arthur 

Download attachment "tun_defer_skb_orphan.patch" of type "application/octet-stream" (934 bytes)