Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755418Ab0DUTWN (ORCPT ); Wed, 21 Apr 2010 15:22:13 -0400 Received: from kroah.org ([198.145.64.141]:57115 "EHLO coco.kroah.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754679Ab0DUTWL (ORCPT ); Wed, 21 Apr 2010 15:22:11 -0400 Date: Wed, 21 Apr 2010 12:16:01 -0700 From: Greg KH To: "Michael S. Tsirkin" Cc: stable@kernel.org, Paul Moore , David Woodhouse , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, qemu-devel , Herbert Xu , Jan Kiszka , "David S. Miller" Subject: Re: [stable] [PATCH] tun: orphan an skb on tx Message-ID: <20100421191601.GJ13228@kroah.com> References: <20100413145944.GA7716@redhat.com> <20100421113557.GA31606@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20100421113557.GA31606@redhat.com> User-Agent: Mutt/1.5.20 (2009-06-14) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2764 Lines: 73 On Wed, Apr 21, 2010 at 02:35:57PM +0300, Michael S. Tsirkin wrote: > On Tue, Apr 13, 2010 at 05:59:44PM +0300, Michael S. Tsirkin wrote: > > The following situation was observed in the field: > > tap1 sends packets, tap2 does not consume them, as a result > > tap1 can not be closed. This happens because > > tun/tap devices can hang on to skbs undefinitely. > > > > As noted by Herbert, possible solutions include a timeout followed by a > > copy/change of ownership of the skb, or always copying/changing > > ownership if we're going into a hostile device. > > > > This patch implements the second approach. > > > > Note: one issue still remaining is that since skbs > > keep reference to tun socket and tun socket has a > > reference to tun device, we won't flush backlog, > > instead simply waiting for all skbs to get transmitted. > > At least this is not user-triggerable, and > > this was not reported in practice, my assumption is > > other devices besides tap complete an skb > > within finite time after it has been queued. > > > > A possible solution for the second issue > > would not to have socket reference the device, > > instead, implement dev->destructor for tun, and > > wait for all skbs to complete there, but this > > needs some thought, probably too risky for 2.6.34. > > > > Signed-off-by: Michael S. Tsirkin > > Tested-by: Yan Vugenfirer > > > > --- > > > > Please review the below, and consider for 2.6.34, > > and stable trees. > > > > drivers/net/tun.c | 4 ++++ > > 1 files changed, 4 insertions(+), 0 deletions(-) > > > > diff --git a/drivers/net/tun.c b/drivers/net/tun.c > > index 96c39bd..4326520 100644 > > --- a/drivers/net/tun.c > > +++ b/drivers/net/tun.c > > @@ -387,6 +387,10 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev) > > } > > } > > > > + /* Orphan the skb - required as we might hang on to it > > + * for indefinite time. */ > > + skb_orphan(skb); > > + > > /* Enqueue packet */ > > skb_queue_tail(&tun->socket.sk->sk_receive_queue, skb); > > dev->trans_start = jiffies; > > -- > > 1.7.0.2.280.gc6f05 > > This is commit 0110d6f22f392f976e84ab49da1b42f85b64a3c5 in net-2.6 > Please cherry-pick this fix in stable kernels (2.6.32 and 2.6.33). David Miller queues up the patches for the network subsystem for the stable trees, and then forwards them to me when he feels they are ready. So I'll defer to him on this one and wait for it to come from him. thanks, greg k-h -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/