netdev - [PATCH] xen/netback: calculate correctly the SKB slots.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 21 May 2012 13:36:33 -0400
From:	Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>
To:	xen-devel@...ts.xensource.com, ian.campbell@...rix.com,
	netdev@...r.kernel.org, davem@...emloft.net,
	linux-kernel@...r.kernel.org
Cc:	Adnan Misherfi <adnan.misherfi@...cle.com>,
	Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>
Subject: [PATCH] xen/netback: calculate correctly the SKB slots.

From: Adnan Misherfi <adnan.misherfi@...cle.com>

A programming error cause the calculation of receive SKB slots to be
wrong, which caused the RX ring to be erroneously declared full,
and the receive queue to be stopped. The problem shows up when two
guest running on the same server tries to communicates using large
MTUs. Each guest is connected to a bridge with VLAN over bond
interface, so traffic from one guest leaves the server on one bridge
and comes back to the second guest on the second bridge. This can be
reproduces using ping, and one guest as follow:

- Create active-back bond (bond0)
- Set up VLAN 5 on bond0 (bond0.5)
- Create a bridge (br1)
- Add bond0.5 to a bridge (br1)
- Start a guest and connect it to br1
- Set MTU of 9000 across the link

Ping the guest from an external host using packet sizes of 3991, and
4054; ping -s 3991 -c 128 "Guest-IP-Address"

At the beginning ping works fine, but after a while ping packets do
not reach the guest because the RX ring becomes full, and the queue
get stopped. Once the problem accrued, the only way to get out of it
is to reboot the guest, or use xm network-detach/network-attach.

ping works for packets sizes 3990,3992, and many other sizes including
4000,5000,9000, and 1500 ..etc. MTU size of 3991,4054 are the sizes
that quickly reproduce this problem.

Signed-off-by: Adnan Misherfi <adnan.misherfi@...cle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>
---
 drivers/net/xen-netback/netback.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 957cf9d..e382e5b 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -212,7 +212,7 @@ unsigned int xenvif_count_skb_slots(struct xenvif *vif, struct sk_buff *skb)
 	int i, copy_off;

 	count = DIV_ROUND_UP(
-			offset_in_page(skb->data)+skb_headlen(skb), PAGE_SIZE);
+			offset_in_page(skb->data + skb_headlen(skb)), PAGE_SIZE);

 	copy_off = skb_headlen(skb) % PAGE_SIZE;

-- 
1.7.7.5

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html