netdev - Re: [PATCH] iwl3945: better skb management in rx path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMcMvshEdsFZ2PVEpaq0e2P4L+cksshjB56x2YvA4wt3T+3__w@mail.gmail.com>
Date:	Fri, 28 Jun 2013 07:38:57 -0700
From:	Paul Stewart <pstew@...gle.com>
To:	Eric Dumazet <eric.dumazet@...il.com>
Cc:	"John W. Linville" <linville@...driver.com>,
	"Steinar H. Gunderson" <sesse@...gle.com>,
	linux-wireless <linux-wireless@...r.kernel.org>,
	netdev <netdev@...r.kernel.org>
Subject: Re: [PATCH] iwl3945: better skb management in rx path

On Fri, Jun 28, 2013 at 5:03 AM, Eric Dumazet <eric.dumazet@...il.com> wrote:
> From: Eric Dumazet <edumazet@...gle.com>
>
> Steinar reported reallocations of skb->head with IPv6, leading to
> a warning in skb_try_coalesce()
>
> It turns out iwl3945 has several problems :
>
> 1) skb->truesize is underestimated.
>    We really consume PAGE_SIZE bytes for a fragment,
>    not the frame length.
> 2) 128 bytes of initial headroom is a bit low and forces reallocations.
> 3) We can avoid consuming a full page for small enough frames.
>
> Reported-by: Steinar H. Gunderson <sesse@...gle.com>
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> ---
> Note : compiled only, I do not have this hardware.
>
>  drivers/net/wireless/iwlegacy/3945.c |   30 +++++++++++++++----------
>  1 file changed, 18 insertions(+), 12 deletions(-)
>
> diff --git a/drivers/net/wireless/iwlegacy/3945.c b/drivers/net/wireless/iwlegacy/3945.c
> index c092033..ad7294f 100644
> --- a/drivers/net/wireless/iwlegacy/3945.c
> +++ b/drivers/net/wireless/iwlegacy/3945.c
> @@ -483,14 +483,13 @@ il3945_pass_packet_to_mac80211(struct il_priv *il, struct il_rx_buf *rxb,
>         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)IL_RX_DATA(pkt);
>         struct il3945_rx_frame_hdr *rx_hdr = IL_RX_HDR(pkt);
>         struct il3945_rx_frame_end *rx_end = IL_RX_END(pkt);
> -       u16 len = le16_to_cpu(rx_hdr->len);
> +       u32 len = le16_to_cpu(rx_hdr->len);
>         struct sk_buff *skb;
>         __le16 fc = hdr->frame_control;
> +       u32 fraglen = PAGE_SIZE << il->hw_params.rx_page_order;
>
>         /* We received data from the HW, so stop the watchdog */
> -       if (unlikely
> -           (len + IL39_RX_FRAME_SIZE >
> -            PAGE_SIZE << il->hw_params.rx_page_order)) {
> +       if (unlikely(len + IL39_RX_FRAME_SIZE > fraglen)) {
>                 D_DROP("Corruption detected!\n");
>                 return;
>         }
> @@ -506,26 +505,33 @@ il3945_pass_packet_to_mac80211(struct il_priv *il, struct il_rx_buf *rxb,
>                 D_INFO("Woke queues - frame received on passive channel\n");
>         }
>
> -       skb = dev_alloc_skb(128);
> +       skb = dev_alloc_skb(256);
>         if (!skb) {
>                 IL_ERR("dev_alloc_skb failed\n");
>                 return;
>         }
>
>         if (!il3945_mod_params.sw_crypto)
> -               il_set_decrypted_flag(il, (struct ieee80211_hdr *)rxb_addr(rxb),
> +               il_set_decrypted_flag(il, (struct ieee80211_hdr *)pkt,
>                                       le32_to_cpu(rx_end->status), stats);
>
> -       skb_add_rx_frag(skb, 0, rxb->page,
> -                       (void *)rx_hdr->payload - (void *)pkt, len,
> -                       len);
> -
> +       /* If frame is small enough to fit into skb->head, copy it
> +        * and do not consume a full page
> +        */
> +       if (len <= 256) {

Presumably this 256 is related to the "dev_alloc_skb(256)"?  It might
be worth making this a constant of some sort so they don't
inadvertently drift apart in the future.

> +               skb_copy_to_linear_data(skb, rx_hdr->payload, len);
> +               skb->tail += len;
> +       } else {
> +               skb_add_rx_frag(skb, 0, rxb->page,
> +                               (void *)rx_hdr->payload - (void *)pkt, len,
> +                               fraglen);
> +               il->alloc_rxb_page--;
> +               rxb->page = NULL;
> +       }
>         il_update_stats(il, false, fc, len);
>         memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
>
>         ieee80211_rx(il->hw, skb);
> -       il->alloc_rxb_page--;
> -       rxb->page = NULL;
>  }
>
>  #define IL_DELAY_NEXT_SCAN_AFTER_ASSOC (HZ*6)
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html