rpms/kernel/F-13 linux-2.6-tun-orphan_an_skb_on_tx.patch, NONE, 1.1 kernel.spec, 1.2004, 1.2005

[Justin M. Forbes]

Author: jforbes

Update of /cvs/pkgs/rpms/kernel/F-13
In directory cvs01.phx2.fedoraproject.org:/tmp/cvs-serv18398

Modified Files:
	kernel.spec 
Added Files:
	linux-2.6-tun-orphan_an_skb_on_tx.patch 
Log Message:
Orphan skb on tx for tun/tap devices where receiver does not consume packets

linux-2.6-tun-orphan_an_skb_on_tx.patch:
 tun.c |    4 ++++
 1 file changed, 4 insertions(+)

--- NEW FILE linux-2.6-tun-orphan_an_skb_on_tx.patch ---
commit 0110d6f22f392f976e84ab49da1b42f85b64a3c5
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Tue Apr 13 04:59:44 2010 +0000

    tun: orphan an skb on tx
    
    The following situation was observed in the field:
    tap1 sends packets, tap2 does not consume them, as a result
    tap1 can not be closed. This happens because
    tun/tap devices can hang on to skbs undefinitely.
    
    As noted by Herbert, possible solutions include a timeout followed by a
    copy/change of ownership of the skb, or always copying/changing
    ownership if we're going into a hostile device.
    
    This patch implements the second approach.
    
    Note: one issue still remaining is that since skbs
    keep reference to tun socket and tun socket has a
    reference to tun device, we won't flush backlog,
    instead simply waiting for all skbs to get transmitted.
    At least this is not user-triggerable, and
    this was not reported in practice, my assumption is
    other devices besides tap complete an skb
    within finite time after it has been queued.
    
    A possible solution for the second issue
    would not to have socket reference the device,
    instead, implement dev->destructor for tun, and
    wait for all skbs to complete there, but this
    needs some thought, probably too risky for 2.6.34.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Tested-by: Yan Vugenfirer <yvugenfi at redhat.com>
    Acked-by: Herbert Xu <herbert at gondor.apana.org.au>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 96c39bd..4326520 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -387,6 +387,10 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
 		}
 	}

+	/* Orphan the skb - required as we might hang on to it
+	 * for indefinite time. */
+	skb_orphan(skb);
+
 	/* Enqueue packet */
 	skb_queue_tail(&tun->socket.sk->sk_receive_queue, skb);
 	dev->trans_start = jiffies;


Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-13/kernel.spec,v
retrieving revision 1.2004
retrieving revision 1.2005
diff -u -p -r1.2004 -r1.2005
--- kernel.spec	27 Apr 2010 04:31:50 -0000	1.2004
+++ kernel.spec	27 Apr 2010 15:53:24 -0000	1.2005
@@ -715,6 +715,7 @@ Patch1555: virt_console-fix-race.patch
 Patch1556: virt_console-fix-fix-race.patch
 Patch1557: virt_console-rollup2.patch
 Patch1558: vhost_net-rollup2.patch
+Patch1559: linux-2.6-tun-orphan_an_skb_on_tx.patch
 
 # fbdev x86-64 primary fix
 Patch1700: linux-2.6-x86-64-fbdev-primary.patch
@@ -1428,6 +1429,7 @@ ApplyPatch virt_console-fix-race.patch
 ApplyPatch virt_console-fix-fix-race.patch
 ApplyPatch virt_console-rollup2.patch
 ApplyPatch vhost_net-rollup2.patch
+ApplyPatch linux-2.6-tun-orphan_an_skb_on_tx.patch
 
 # Fix block I/O errors in KVM
 #ApplyPatch linux-2.6-block-silently-error-unsupported-empty-barriers-too.patch
@@ -2176,6 +2178,9 @@ fi
 # and build.
 
 %changelog
+* Tue Apr 27 2010 Justin M. Forbes <jforbes at redhat.com>
+- Orphan an skb on tx for tun/tap devices.
+
 * Tue Apr 27 2010 Chuck Ebbert <cebbert at redhat.com>  2.6.33.2-68
 - Fix possible data corruption with ext4 mounted with -o discard