lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 23 Aug 2018 03:04:42 +0200 From: Dominique Martinet <asmadeus@...ewreck.org> To: Dave Watson <davejwatson@...com> Cc: Doron Roberts-Kedes <doronrk@...com>, Tom Herbert <tom@...ntonium.net>, "David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org, linux-kernel@...r.kernel.org Subject: Re: [PATCH] strparser: remove any offset before parsing messages Dave Watson wrote on Wed, Aug 22, 2018: > > I've tried measuring that overhead as well by writing a more complex bpf > > program that would fetch the offset in the skb but for some reason I'm > > reading a 0 offset when it's not zero... well, not like there's much > > choice for this at this point anyway; I don't think we'll do this > > without pull, I'll put that on background. > > For what it is worth we checked the offset in bpf, something > along the lines of Oh, thanks! > > struct kcm_rx_msg { int full_len; int offset;}; > static inline struct kcm_rx_msg *kcm_rx_msg(struct __sk_buff *skb) > { return (struct kcm_rx_msg *)skb->cb;} > > int decode_framing(struct __sk_buff *skb) > { return load_word(skb, kcm_rx_msg(skb)->offset);} So you're taking directly the address at skb->cb but the linux code has this function: static inline struct strp_msg *strp_msg(struct sk_buff *skb) { return (struct strp_msg *)((void *)skb->cb + offsetof(struct qdisc_skb_cb, data)); } and qdisc_skb_cb.data is another 8 bytes in, that would explain I had different results (and now I'm trying your snippet it does work), but I'll have to admit I fail to understand this.... Ok, so 'cb' in __sk_buff is 48 bytes in but 'cb' in sk_buff is 40 bytes in -- I might just start getting annoyed over this, is there a reason for the different offset?! > Although it did puzzle me for a while figuring that out when I ran in > to it. Well, at least it means some people were aware of the problem and worked around it in their own way -- what do you think of pulling instead? I mean, we could just document that "really well" and provide the get-offset function in some header that would be made include-able from bpf.. But right now this isn't really the case. FWIW now I have this version I also don't notice any performance change with the pull on my example, it actually looks like the bpf load_word is slightly slower than pull to access data that is not in the head, but the noise level is pretty bad. Thanks, -- Dominique
Powered by blists - more mailing lists