tun: make tun_build_skb() thread safe

tun_build_skb() is not thread safe since it uses per queue page frag,
this will break things when multiple threads are sending through same
queue. Switch to use per-thread generator (no lock involved).

Fixes: 66ccbc9c87c2 ("tap: use build_skb() for small packet")
Tested-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index f5017121cd57095b275459caf1cb61d66e77c250..19cbbbb1b63bbd74fcf7e74faf6541b3b7472b65 100644 (file)
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -175,7 +175,6 @@ struct tun_file {
        struct list_head next;
        struct tun_struct *detached;
        struct skb_array tx_array;
-       struct page_frag alloc_frag;
 };
 
 struct tun_flow_entry {
@@ -578,8 +577,6 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
                }
                if (tun)
                        skb_array_cleanup(&tfile->tx_array);
-               if (tfile->alloc_frag.page)
-                       put_page(tfile->alloc_frag.page);
                sock_put(&tfile->sk);
        }
 }
@@ -1272,7 +1269,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
                                     struct virtio_net_hdr *hdr,
                                     int len, int *generic_xdp)
 {
-       struct page_frag *alloc_frag = &tfile->alloc_frag;
+       struct page_frag *alloc_frag = &current->task_frag;
        struct sk_buff *skb;
        struct bpf_prog *xdp_prog;
        int buflen = SKB_DATA_ALIGN(len + TUN_RX_PAD) +
@@ -2580,8 +2577,6 @@ static int tun_chr_open(struct inode *inode, struct file * file)
        tfile->sk.sk_write_space = tun_sock_write_space;
        tfile->sk.sk_sndbuf = INT_MAX;
 
-       tfile->alloc_frag.page = NULL;
-
        file->private_data = tfile;
        INIT_LIST_HEAD(&tfile->next);