Commit 4b663366 authored by Alexis Bauvin's avatar Alexis Bauvin Committed by David S. Miller
Browse files

tun: mark small packets as owned by the tap sock

- v1 -> v2: Move skb_set_owner_w to __tun_build_skb to reduce patch size

Small packets going out of a tap device go through an optimized code
path that uses build_skb() rather than sock_alloc_send_pskb(). The
latter calls skb_set_owner_w(), but the small packet code path does not.

The net effect is that small packets are not owned by the userland
application's socket (e.g. QEMU), while large packets are.
This can be seen with a TCP session, where packets are not owned when
the window size is small enough (around PAGE_SIZE), while they are once
the window grows (note that this requires the host to support virtio
tso for the guest to offload segmentation).
All this leads to inconsistent behaviour in the kernel, especially on
netfilter modules that uses sk->socket (e.g. xt_owner).

Fixes: 66ccbc9c

 ("tap: use build_skb() for small packet")
Signed-off-by: default avatarAlexis Bauvin <>
Acked-by: default avatarJason Wang <>
Signed-off-by: default avatarDavid S. Miller <>
parent 16b2084a
......@@ -1599,7 +1599,8 @@ static bool tun_can_build_skb(struct tun_struct *tun, struct tun_file *tfile,
return true;
static struct sk_buff *__tun_build_skb(struct page_frag *alloc_frag, char *buf,
static struct sk_buff *__tun_build_skb(struct tun_file *tfile,
struct page_frag *alloc_frag, char *buf,
int buflen, int len, int pad)
struct sk_buff *skb = build_skb(buf, buflen);
......@@ -1609,6 +1610,7 @@ static struct sk_buff *__tun_build_skb(struct page_frag *alloc_frag, char *buf,
skb_reserve(skb, pad);
skb_put(skb, len);
skb_set_owner_w(skb, tfile->;
alloc_frag->offset += buflen;
......@@ -1686,7 +1688,8 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
if (hdr->gso_type || !xdp_prog) {
*skb_xdp = 1;
return __tun_build_skb(alloc_frag, buf, buflen, len, pad);
return __tun_build_skb(tfile, alloc_frag, buf, buflen, len,
*skb_xdp = 0;
......@@ -1723,7 +1726,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
return __tun_build_skb(alloc_frag, buf, buflen, len, pad);
return __tun_build_skb(tfile, alloc_frag, buf, buflen, len, pad);
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment