[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CANn89iJAjEm47Cqt2=5fEnFFVNH-KQbemmqkEfJFUtJZ+c4QRQ@mail.gmail.com>
Date: Thu, 25 Jan 2024 17:54:18 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: Matthew Wilcox <willy@...radead.org>
Cc: "David S . Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>,
Paolo Abeni <pabeni@...hat.com>, Neal Cardwell <ncardwell@...gle.com>, netdev@...r.kernel.org,
eric.dumazet@...il.com, ZhangPeng <zhangpeng362@...wei.com>,
Arjun Roy <arjunroy@...gle.com>, linux-mm@...ck.org,
Andrew Morton <akpm@...ux-foundation.org>, linux-fsdevel@...r.kernel.org
Subject: Re: [PATCH net] tcp: add sanity checks to rx zerocopy
On Thu, Jan 25, 2024 at 5:09 PM Matthew Wilcox <willy@...radead.org> wrote:
>
>
> Fixing email address for linux-mm.
>
> On Thu, Jan 25, 2024 at 04:07:50PM +0000, Matthew Wilcox wrote:
> > On Thu, Jan 25, 2024 at 10:33:17AM +0000, Eric Dumazet wrote:
> > > +++ b/net/ipv4/tcp.c
> > > @@ -1786,7 +1786,17 @@ static skb_frag_t *skb_advance_to_frag(struct sk_buff *skb, u32 offset_skb,
> > >
> > > static bool can_map_frag(const skb_frag_t *frag)
> > > {
> > > - return skb_frag_size(frag) == PAGE_SIZE && !skb_frag_off(frag);
> > > + struct page *page;
> > > +
> > > + if (skb_frag_size(frag) != PAGE_SIZE || skb_frag_off(frag))
> > > + return false;
> > > +
> > > + page = skb_frag_page(frag);
> > > +
> > > + if (PageCompound(page) || page->mapping)
> > > + return false;
> >
> > I'm not entirely sure why you're testing PageCompound here. If a driver
> > allocates a compound page, we'd still want to be able to insert it,
> > right?
I tried to get something that would be free of merge conflicts, up to linux-4.18
I was not sure if I had to use compound_head(page) in order to test
for the mapping ?
page = compound_head(page);
if (page->mapping)
return false;
I guess that we would have to adjust the page pointer based on
skb_frag_off(frag),
right now we bail if skb_frag_off(frag) is not zero.
I would leave this change for future kernels if there is interest.
> >
> > I have a feeling that we want to fix this in the VM layer. There are
> > some weird places calling vm_insert_page() and we should probably make
> > them all fail.
> >
> > Something like this, perhaps?
Perhaps, but backports to stable versions (without folio) would be a
bit of a work ?
> >
> > diff --git a/mm/memory.c b/mm/memory.c
> > index 1a60faad2e49..ae0abab56d38 100644
> > --- a/mm/memory.c
> > +++ b/mm/memory.c
> > @@ -1871,6 +1871,10 @@ static int insert_page_into_pte_locked(struct vm_area_struct *vma, pte_t *pte,
> >
> > if (!pte_none(ptep_get(pte)))
> > return -EBUSY;
> > + if (folio->mapping &&
> > + ((addr - vma->vm_start) / PAGE_SIZE + vma->vm_pgoff) !=
> > + (folio->index + folio_page_idx(folio, page)))
> > + return -EINVAL;
> > /* Ok, finally just insert the thing.. */
> > folio_get(folio);
> > inc_mm_counter(vma->vm_mm, mm_counter_file(folio));
> >
Powered by blists - more mailing lists