netdev - Re: [PATCH] net: af_packet: don't call tpacket_destruct

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1284138733.24675.104.camel@edumazet-laptop>
Date:	Fri, 10 Sep 2010 19:12:13 +0200
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Changli Gao <xiaosuo@...il.com>
Cc:	"David S. Miller" <davem@...emloft.net>,
	Oliver Hartkopp <socketcan@...tkopp.net>,
	"Michael S. Tsirkin" <mst@...hat.com>, netdev@...r.kernel.org
Subject: Re: [PATCH] net: af_packet: don't call tpacket_destruct_skb()
 until the skb is sent out

Le vendredi 10 septembre 2010 à 18:58 +0200, Eric Dumazet a écrit :
> Le samedi 11 septembre 2010 à 00:47 +0800, Changli Gao a écrit :
> > On Fri, Sep 10, 2010 at 10:26 PM, Eric Dumazet <eric.dumazet@...il.com> wrote:
> 
> 
> > > Are you sure sock_wfree(skb) is still needed ?
> > 
> > sock_wfree(skb) is also used to wake up the users who sleep on
> > poll(2). If sock_wfree(skb) is moved into skb->destructor(), and
> > called before skb is sent out, pollers will be waked up without
> > POLLOUT, and since the later skb_shinfo(skb)->destructor() doesn't
> > wake up the pollers, POLLOUT events will be lost, and the poller will
> > be blocked forever.
> > 
> 
> Then implement poll() to use the number of available slots.
> (not use the default poll() that relies on generic sk / inet queues and
> counters)
> 
> Really, sock_wfree() cannot be used at all, or we also must disable
> early orphaning of these skbs.
> 
> Goal is to replace skb->destructor use in af_packet by
> shinfo->destructor, not mix the two.

Thinking again about this, we also might avoid taking references on
pages and releasing references too.

shinfo->destructor should replace the skb_release_data() logic,
not complement it.

if (shinfo->destructor) {
	shinfo->destructor(skb);
} else {
	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
		put_page(skb_shinfo(skb)->frags[i].page);
	if (skb_has_frag_list(skb))
	....
	kfree(skb->head);
}


As long as the mmap zone is correctly protected in af_packet code, of
course (not releasing it as long as some packets are still in flight)



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html