On Thu, Feb 15, 2018 at 9:20 AM, Eric Dumazet <eduma...@google.com> wrote: > > Yes, it seems tun.c breaks the assumptions. > > If it really wants to provide arbitrary fragments and alignments, it > should use a separate
Sorry, I have sent the message to soon. tun.c should use a private 'struct page_frag_cache' to deliver arbitrary frags/alignments, so that syzkaller might catch interesting bugs in the stack. > > Please try : > > diff --git a/drivers/net/tun.c b/drivers/net/tun.c > index > 81e6cc951e7fc7c983919365c34842c34bcaedcf..92c6b6d02f7c18b63c42ffe1d9cb7286975e1263 > 100644 > --- a/drivers/net/tun.c > +++ b/drivers/net/tun.c > @@ -1500,7 +1500,7 @@ static struct sk_buff > *tun_napi_alloc_frags(struct tun_file *tfile, > } > > local_bh_disable(); > - data = napi_alloc_frag(fragsz); > + data = napi_alloc_frag(SKB_DATA_ALIGN(fragsz)); > local_bh_enable(); > if (!data) { > err = -ENOMEM; This patch should solve your immediate problem, but would lower fuzzer abilities to find bugs. I will send something more suited to original intent of these commits : 90e33d45940793def6f773b2d528e9f3c84ffdc7 tun: enable napi_gro_frags() for TUN/TAP driver 943170998b200190f99d3fe7e771437e2c51f319 tun: enable NAPI for TUN/TAP driver