netdev - Re: [PATCH bpf-next] bpf/xdp: optimize bpf_xdp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <f6b26173-fa51-662c-ae40-3f776abf9c7b@redhat.com>
Date: Wed, 31 May 2023 19:54:23 +0200
From: Jesper Dangaard Brouer <jbrouer@...hat.com>
To: Toke Høiland-Jørgensen <toke@...hat.com>,
 Lorenzo Bianconi <lorenzo@...nel.org>
Cc: brouer@...hat.com, Tariq Toukan <ttoukan.linux@...il.com>,
 Daniel Borkmann <borkmann@...earbox.net>, Alexei Starovoitov
 <ast@...nel.org>, Andrii Nakryiko <andrii.nakryiko@...il.com>,
 bpf@...r.kernel.org, Tariq Toukan <tariqt@...dia.com>, gal@...dia.com,
 netdev@...r.kernel.org, echaudro@...hat.com, andrew.gospodarek@...adcom.com
Subject: Re: [PATCH bpf-next] bpf/xdp: optimize bpf_xdp_pointer to avoid
 reading sinfo



On 31/05/2023 18.24, Toke Høiland-Jørgensen wrote:
> Lorenzo Bianconi <lorenzo@...nel.org> writes:
> 
>>> Currently we observed a significant performance degradation in
>>> samples/bpf xdp1 and xdp2, due XDP multibuffer "xdp.frags" handling,
>>> added in commit 772251742262 ("samples/bpf: fixup some tools to be able
>>> to support xdp multibuffer").
>>>
>>> This patch reduce the overhead by avoiding to read/load shared_info
>>> (sinfo) memory area, when XDP packet don't have any frags. This improves
>>> performance because sinfo is located in another cacheline.
>>>
>>> Function bpf_xdp_pointer() is used by BPF helpers bpf_xdp_load_bytes()
>>> and bpf_xdp_store_bytes(). As a help to reviewers, xdp_get_buff_len() can
>>> potentially access sinfo.
>>>
>>> Perf report show bpf_xdp_pointer() percentage utilization being reduced
>>> from 4,19% to 3,37% (on CPU E5-1650 @3.60GHz).
>>>
>>> The BPF kfunc bpf_dynptr_slice() also use bpf_xdp_pointer(). Thus, it
>>> should also take effect for that.
>>>
>>> Signed-off-by: Jesper Dangaard Brouer <brouer@...hat.com>
>>> ---
>>>   net/core/filter.c |   12 ++++++++----
>>>   1 file changed, 8 insertions(+), 4 deletions(-)
>>>
>>> diff --git a/net/core/filter.c b/net/core/filter.c
>>> index 968139f4a1ac..a635f537d499 100644
>>> --- a/net/core/filter.c
>>> +++ b/net/core/filter.c
>>> @@ -3948,20 +3948,24 @@ void bpf_xdp_copy_buf(struct xdp_buff *xdp, unsigned long off,
>>>   
>>>   void *bpf_xdp_pointer(struct xdp_buff *xdp, u32 offset, u32 len)
>>>   {
>>> -	struct skb_shared_info *sinfo = xdp_get_shared_info_from_buff(xdp);
>>>   	u32 size = xdp->data_end - xdp->data;
>>> +	struct skb_shared_info *sinfo;
>>>   	void *addr = xdp->data;
>>>   	int i;
>>>   
>>>   	if (unlikely(offset > 0xffff || len > 0xffff))
>>>   		return ERR_PTR(-EFAULT);
>>>   
>>> -	if (offset + len > xdp_get_buff_len(xdp))
>>> -		return ERR_PTR(-EINVAL);
>>> +	if (likely((offset < size))) /* linear area */
>>> +		goto out;
>>
>> Hi Jesper,
>>
>> please correct me if I am wrong but looking at the code, in this way
>> bpf_xdp_pointer() will return NULL (and not ERR_PTR(-EINVAL)) if:
>> - offset < size
>> - offset + len > xdp_get_buff_len()
>>
>> doing so I would say bpf_xdp_copy_buf() will copy the full packet starting from
>> offset leaving some part of the auxiliary buffer possible uninitialized.
>> Do you think it is an issue?
> 
> Yeah, you're right, bpf_xdp_load_bytes() should fail if trying to read
> beyond the frame, and in this case it won't for non-frags; that's a
> change in behaviour we probably shouldn't be making...
> 

Thanks for spotting this!
I will work on a V2 tomorrow.

--Jesper