netdev - RE: [net-next 03/12] i40e: Handle a single mss packet with more than 8 frags

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 17 Nov 2014 16:04:18 +0000
From:	"Nelson, Shannon" <shannon.nelson@...el.com>
To:	Eric Dumazet <eric.dumazet@...il.com>,
	"Kirsher, Jeffrey T" <jeffrey.t.kirsher@...el.com>
CC:	"davem@...emloft.net" <davem@...emloft.net>,
	"Kong, Serey" <serey.kong@...el.com>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"nhorman@...hat.com" <nhorman@...hat.com>,
	"sassmann@...hat.com" <sassmann@...hat.com>,
	"jogreene@...hat.com" <jogreene@...hat.com>
Subject: RE: [net-next 03/12] i40e: Handle a single mss packet with more
 than 8 frags

> -----Original Message-----
> From: Eric Dumazet [mailto:eric.dumazet@...il.com]
> Sent: Saturday, November 15, 2014 10:22 AM
> 
> On Fri, 2014-11-14 at 22:08 -0800, Jeff Kirsher wrote:
> > From: Serey Kong <serey.kong@...el.com>
> >
> > This handles the case where a single packet with more than 8 data
> > descriptors triggers a Malicious Driver Detect event in the device.
> >

[...]

> > -	if (tx_flags & (I40E_TX_FLAGS_TSO | I40E_TX_FLAGS_FSO))
> > +	if (tx_flags & (I40E_TX_FLAGS_TSO | I40E_TX_FLAGS_FSO)) {
> >  		gso_segs = skb_shinfo(skb)->gso_segs;
> > -	else
> > +	} else {
> >  		gso_segs = 1;
> > +		if (skb_shinfo(skb)->nr_frags >= I40E_MAX_BUFFER_TXD)
> > +			skb_linearize(skb);
> 
> What exactly happens if skb_linearize() fails ?
> 
> Is this "Malicious Driver Detect event" fatal or simply packet is
> dropped without additional harm ?

This typically hits when there are many little TSO packets in a single MTU size frame.  The hardware doesn't like dealing with more than 8 separate buffers.

If skb_linearize() fails and we try to send the skb as is, the hardware will throw an MDD event and disable that particular queue, possibly causing a Tx hang, which will lead to a PF reset and then we continue on.  It's a bit of a hit to throughput, and most folks get a little annoyed when seeing the Tx hang stack trace in their log, but it generally isn't fatal.

If we disable the MDD detection, the hardware ends up putting garbage on the wire.

It looks to me that the way for skb_linearize() to fail is with -ENOMEM, in which case we probably have other issues.

If there are some alternative suggestions for dealing with this, we'd be happy to hear about them.

Cheers,
sln