netdev - Re: [PATCH V2 net-next-2.6] net: relax dst refcnt in input path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 07 Aug 2009 07:05:38 +0200
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	David Miller <davem@...emloft.net>
CC:	kaber@...sh.net, netdev@...r.kernel.org, markmc@...hat.com
Subject: Re: [PATCH V2 net-next-2.6] net: relax dst refcnt in input path

David Miller a écrit :
> From: Eric Dumazet <eric.dumazet@...il.com>
> Date: Wed, 22 Jul 2009 17:40:06 +0200
> 
>> [PATCH net-next-2.6] net: relax dst refcnt in input path
> 
> 
> Two things:
> 
> 1) Don't use a boolean name like "noref" it results in using
>    double-negatives in one's mind while trying to read and understand
>    the code.
> 
>    Call these arguments "need_ref" or something like that.
> 
>    Also, use "bool" type.

Sure

> 
> 2) I wonder about this:
> 
>> @@ -1700,9 +1700,15 @@ int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
>>  		 * If device doesnt need skb->dst, release it right now while
>>  		 * its hot in this cpu cache
>>  		 */
>> -		if (dev->priv_flags & IFF_XMIT_DST_RELEASE)
>> -			skb_dst_drop(skb);
>> -
>> +		if (skb_dst(skb)) {
>> +			if (dev->priv_flags & IFF_XMIT_DST_RELEASE)
>> +				skb_dst_drop(skb);
>> +			else
>> +				/*
>> +				 * make sure dst was refcounted by caller
>> +				 */
>> +				WARN_ON(!(skb->_skb_dst & SKB_DST_REFTAKEN));
>> +		}
>>  		rc = ops->ndo_start_xmit(skb, dev);
>>  		if (rc == NETDEV_TX_OK)
> 
> So, won't this warning trigger if we are forwarding to a device that
> does not set IFF_XMIT_DST_RELEASE?

If this device has a queue, we do a skb_dst_force() in dev_queue_xmit()

> 
> If I understand things correctly, in IPv4 when we're not delivering to
> a socket, we don't take a reference.

yes, that would be the trick

> 
> We'll get here from the forwarding path with a DST, and the target TX
> device has IFF_XMIT_DST_RELEASE clear, the WARN_ON above will trigger.

I added this warning to make sure I called skb_dst_force(skb)
from dev_queue_xmit() if device has a queue (packet might be queued
and thus escape from rcu lock section)

I suppose I should also skb_dst_force() if device has no queue and
has IFF_XMIT_DST_RELEASE cleared. Or should audit all these devices
and insert the skb_dst_force() if the packet must be queued in a driver queue,
and its dst needed later. 

I'll respin patch anyway since commit bbd8a0d3a3b65d341437f8b99c828fa5cc29c739
(net: Avoid enqueuing skb for default qdiscs)
changed too many things, when I'll come back from vacations in two weeks.

Or if you prefer, I might submit it today (my vacations start tomorrow), but
please dont apply it while I cannot react to any bug report :)

Thanks a lot
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html