netdev - Re: Freeing 'temporary' IPv4 route table entries.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3cfcd1b7-96e4-a5b6-21e7-8182a367f349@gmail.com>
Date:   Fri, 31 Jan 2020 07:53:46 -0800
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     David Laight <David.Laight@...LAB.COM>,
        netdev <netdev@...r.kernel.org>
Subject: Re: Freeing 'temporary' IPv4 route table entries.



On 1/31/20 2:26 AM, David Laight wrote:
> If I call sendmsg() on a raw socket (or probably
> an unconnected UDP one) rt_dst_alloc() is called
> in the bowels of ip_route_output_flow() to hold
> the remote address.
> 
> Much later __dev_queue_xmit() calls dst_release()
> to delete the 'dst' referenced from the skb.
> 
> Prior to f8864972 it did just that.
> Afterwards the actual delete is 'laundered' through the
> rcu callbacks.
> This is probably ok for dst that are actually attached
> to sockets or tunnels (which aren't freed very often).
> But it leads to horrid long rcu callback sequences
> when a lot of messages are sent.
> (A sample of 1 gave nearly 100 deletes in one go.)
> There is also the additional cost of deferring the free
> (and the extra retpoline etc).
> 
> ISTM that the dst_alloc() done during a send should
> set a flag so that the 'dst' can be immediately
> freed since it is known that no one can be picking up
> a reference as it is being freed.
> 
> Thoughts?
> 

I thought these routes were cached in per-cpu caches.

At least for UDP I do not see rcu callbacks being queueed.