netdev - Re: [PATCH net-next 3/5] net: batch zerocopy_fill_skb_from

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <330dbf5b-4022-4ceb-a658-a182c16f9f59@gmail.com>
Date: Mon, 1 Jul 2024 12:11:12 +0100
From: Pavel Begunkov <asml.silence@...il.com>
To: Willem de Bruijn <willemdebruijn.kernel@...il.com>,
 io-uring@...r.kernel.org, netdev@...r.kernel.org
Cc: Jens Axboe <axboe@...nel.dk>, "David S . Miller" <davem@...emloft.net>,
 Jakub Kicinski <kuba@...nel.org>, David Ahern <dsahern@...nel.org>,
 Eric Dumazet <edumazet@...gle.com>
Subject: Re: [PATCH net-next 3/5] net: batch zerocopy_fill_skb_from_iter
 accounting

On 6/28/24 18:06, Willem de Bruijn wrote:
> Pavel Begunkov wrote:
>> Instead of accounting every page range against the socket separately, do
>> it in batch based on the change in skb->truesize. It's also moved into
>> __zerocopy_sg_from_iter(), so that zerocopy_fill_skb_from_iter() is
>> simpler and responsible for setting frags but not the accounting.
>>
>> Signed-off-by: Pavel Begunkov <asml.silence@...il.com>
> 
> Reviewed-by: Willem de Bruijn <willemb@...gle.com>

Thanks for reviews!

>> ---
>>   net/core/datagram.c | 31 ++++++++++++++++++-------------
>>   1 file changed, 18 insertions(+), 13 deletions(-)
>>
>> diff --git a/net/core/datagram.c b/net/core/datagram.c
>> index 7f7d5da2e406..2b24d69b1e94 100644
>> --- a/net/core/datagram.c
>> +++ b/net/core/datagram.c
>> @@ -610,7 +610,7 @@ int skb_copy_datagram_from_iter(struct sk_buff *skb, int offset,
>>   }
>>   EXPORT_SYMBOL(skb_copy_datagram_from_iter);
>>   
>> -static int zerocopy_fill_skb_from_iter(struct sock *sk, struct sk_buff *skb,
>> +static int zerocopy_fill_skb_from_iter(struct sk_buff *skb,
>>   					struct iov_iter *from, size_t length)
>>   {
>>   	int frag = skb_shinfo(skb)->nr_frags;
>> @@ -621,7 +621,6 @@ static int zerocopy_fill_skb_from_iter(struct sock *sk, struct sk_buff *skb,
>>   		int refs, order, n = 0;
>>   		size_t start;
>>   		ssize_t copied;
>> -		unsigned long truesize;
>>   
>>   		if (frag == MAX_SKB_FRAGS)
>>   			return -EMSGSIZE;
> 
> Does the existing code then incorrectly not unwind sk_wmem_queued_add
> and sk_mem_charge if returning with error from the second or later
> loop..

As long as ->truesize matches what's accounted to the socket,
kfree_skb() -> sock_wfree()/->destructor() should take care of it.
With sk_mem_charge() I assume __zerocopy_sg_from_iter -> ___pskb_trim()
should do it, need to look it up, but if not, it sounds like a temporary
over estimation until the skb is put down. I don't see anything
concerning. Is that the scenario you're worried about?

-- 
Pavel Begunkov