netdev - Re: [PATCH net-next v3] xsk: skip validating skb list in xmit path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b859fd65-d7bb-45bf-b7f8-e6701c418c1f@redhat.com>
Date: Thu, 27 Nov 2025 13:02:00 +0100
From: Paolo Abeni <pabeni@...hat.com>
To: Jason Xing <kerneljasonxing@...il.com>, davem@...emloft.net,
 edumazet@...gle.com, kuba@...nel.org, bjorn@...nel.org,
 magnus.karlsson@...el.com, maciej.fijalkowski@...el.com,
 jonathan.lemon@...il.com, sdf@...ichev.me, ast@...nel.org,
 daniel@...earbox.net, hawk@...nel.org, john.fastabend@...il.com
Cc: bpf@...r.kernel.org, netdev@...r.kernel.org,
 Jason Xing <kernelxing@...cent.com>
Subject: Re: [PATCH net-next v3] xsk: skip validating skb list in xmit path

On 11/25/25 12:57 PM, Jason Xing wrote:
> This patch also removes total ~4% consumption which can be observed
> by perf:
> |--2.97%--validate_xmit_skb
> |          |
> |           --1.76%--netif_skb_features
> |                     |
> |                      --0.65%--skb_network_protocol
> |
> |--1.06%--validate_xmit_xfrm
> 
> The above result has been verfied on different NICs, like I40E. I
> managed to see the number is going up by 4%.

I must admit this delta is surprising, and does not fit my experience in
slightly different scenarios with the plain UDP TX path.

> [1] - analysis of the validate_xmit_skb()
> 1. validate_xmit_unreadable_skb()
>    xsk doesn't initialize skb->unreadable, so the function will not free
>    the skb.
> 2. validate_xmit_vlan()
>    xsk also doesn't initialize skb->vlan_all.
> 3. sk_validate_xmit_skb()
>    skb from xsk_build_skb() doesn't have either sk_validate_xmit_skb or
>    sk_state, so the skb will not be validated.
> 4. netif_needs_gso()
>    af_xdp doesn't support gso/tso.
> 5. skb_needs_linearize() && __skb_linearize()
>    skb doesn't have frag_list as always, so skb_has_frag_list() returns
>    false. In copy mode, skb can put more data in the frags[] that can be
>    found in xsk_build_skb_zerocopy().

I'm not sure  parse this last sentence correctly, could you please
re-phrase?

I read it as as the xsk xmit path could build skb with nr_frags > 0.
That in turn will need validation from
validate_xmit_skb()/skb_needs_linearize() depending on the egress device
(lack of NETIF_F_SG), regardless of any other offload required.

/P