netdev - Re: [RFC] truesize lies

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 10 Oct 2011 08:54:57 +0200
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	David Miller <davem@...emloft.net>
Cc:	netdev@...r.kernel.org
Subject: Re: [RFC] truesize lies

Le dimanche 09 octobre 2011 à 18:10 -0400, David Miller a écrit :
> From: Eric Dumazet <eric.dumazet@...il.com>
> Date: Sun, 09 Oct 2011 23:55:20 +0200
> 
> > Some drivers splits a page in two (or more) pieces, so we cant know what
> > was really reserved by a driver for paged skbs.
> > 
> > Only thing we could enforce at the moment is the proper accounting for
> > skb head :
> > 
> > WARN_ON(skb->truesize < (skb_end_pointer(skb) - skb->head) + sizeof(sk_buff) + skb->data_len);
> 
> This is partly true.
> 
> Drivers that use page pools divide pages up into different pools, each
> with some specific block size.  At least this is how NIU works.
> 
> So NIU knows exactly how much of the block is logically part of that
> SKB yet unused.
> 
> And if we really wanted to we could add a frag[].reserved field that
> keeps track of this for debugging.

Hmm, this would still be possible for a driver to lie and consume lot of
ram on 64bit arches.

How about using a "struct page" field then, since for a given page, we
can assume/enforce it was divided in equal units (kind of a negative
order) by a driver.

Instead of using alloc_page(order) a driver could use

alloc_page_truesize(gfp_t mask, int page_order, int subunit_order)

For example, an x86 driver using 4KB page splitted in two pieces would
use alloc_page_truesize(gfp, 0, 1)

To get frag[i].reserved (aka truesize), we then would do

static inline int frag_truesize(const skb_frag_t *frag)
{
	return compound_head(frag->page)->truesize;
}

(Not even sure compound_head() is even necessary here, but I see NIU
uses it in niu_rbr_add_page() ?)


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html