netdev - Re: [PATCH net-next v2] net/smc: Reduce overflow of smc clcsock listen queue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8a60dabb-1799-316c-80b5-14c920fe98ab@linux.ibm.com>
Date:   Tue, 4 Jan 2022 14:45:35 +0100
From:   Karsten Graul <kgraul@...ux.ibm.com>
To:     "D. Wythe" <alibuda@...ux.alibaba.com>
Cc:     kuba@...nel.org, davem@...emloft.net, netdev@...r.kernel.org,
        linux-s390@...r.kernel.org, linux-rdma@...r.kernel.org
Subject: Re: [PATCH net-next v2] net/smc: Reduce overflow of smc clcsock
 listen queue

On 04/01/2022 14:12, D. Wythe wrote:
> From: "D. Wythe" <alibuda@...ux.alibaba.com>
> 
> In nginx/wrk multithread and 10K connections benchmark, the
> backend TCP connection established very slowly, and lots of TCP
> connections stay in SYN_SENT state.

I see what you are trying to solve here.
So what happens with your patch now is that we are accepting way more connections
in advance and queue them up for the SMC connection handshake worker.
The connection handshake worker itself will not run faster with this change, so overall
it should be the same time that is needed to establish all connections.
What you solve is that when 10k connections are started at the same time, some of them
will be dropped due to tcp 3-way handshake timeouts. Your patch avoids that but one can now flood
the stack with an ~infinite amount of dangling sockets waiting for the SMC handshake, maybe even 
causing oom conditions.

What should be respected with such a change would be the backlog parameter for the listen socket,
i.e. how many backlog connections are requested by the user space application?
There is no such handling of backlog right now, and due to the 'braking' workers we avoided
to flood the kernel with too many dangling connections. With your change there should be a way to limit
this ind of connections in some way.