From: Daniel Borkmann <daniel@iogearbox•net>
To: Benjamin Poirier <bpoirier@suse•com>, netdev@vger•kernel.org
Cc: Eric Dumazet <eric.dumazet@gmail•com>,
Hannes Frederic Sowa <hannes@stressinduktion•org>,
Hideaki YOSHIFUJI <yoshfuji@linux-ipv6•org>
Subject: Re: [PATCH] mld, igmp: Fix reserved tailroom calculation
Date: Mon, 29 Feb 2016 15:57:46 +0100 [thread overview]
Message-ID: <56D45C6A.5040606@iogearbox.net> (raw)
In-Reply-To: <1456603028-12589-2-git-send-email-bpoirier@suse.com>
Hi Benjamin,
[ -Cc my old RH address ]
On 02/27/2016 08:57 PM, Benjamin Poirier wrote:
> The current reserved_tailroom calculation fails to take hlen and tlen into
> account.
>
> skb:
> [__hlen__|__data____________|__tlen___|__extra__]
> ^ ^
> head skb_end_offset
>
> In this representation, hlen + data + tlen is the size passed to alloc_skb.
> "extra" is the extra space made available in __alloc_skb because of
> rounding up by kmalloc. We can reorder the representation like so:
>
> [__hlen__|__data____________|__extra__|__tlen___]
> ^ ^
> head skb_end_offset
>
> The maximum space available for ip headers and payload without
> fragmentation is min(mtu, data + extra). Therefore,
> reserved_tailroom
> = data + extra + tlen - min(mtu, data + extra)
> = skb_end_offset - hlen - min(mtu, skb_end_offset - hlen - tlen)
> = skb_tailroom - min(mtu, skb_tailroom - tlen) ; after skb_reserve(hlen)
>
> Compare the second line to the current expression:
> reserved_tailroom = skb_end_offset - min(mtu, skb_end_offset)
> and we can see that hlen and tlen are not taken into account.
>
> Depending on hlen, tlen, mtu and the number of multicast address records,
> the current code may output skbs that have less tailroom than
> dev->needed_tailroom or it may output more skbs than needed because not all
> space available is used.
>
> Fixes: 4c672e4b ("ipv6: mld: fix add_grhead skb_over_panic for devs with large MTUs")
> Signed-off-by: Benjamin Poirier <bpoirier@suse•com>
> ---
> net/ipv4/igmp.c | 4 ++--
> net/ipv6/mcast.c | 4 ++--
> 2 files changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
> index 05e4cba..b5d28a4 100644
> --- a/net/ipv4/igmp.c
> +++ b/net/ipv4/igmp.c
[...]
[ cutting the IPv4 part off as diff is the same ]
> diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
> index 5ee56d0..c157edc 100644
> --- a/net/ipv6/mcast.c
> +++ b/net/ipv6/mcast.c
> @@ -1574,9 +1574,9 @@ static struct sk_buff *mld_newpack(struct inet6_dev *idev, unsigned int mtu)
> return NULL;
>
> skb->priority = TC_PRIO_CONTROL;
> - skb->reserved_tailroom = skb_end_offset(skb) -
> - min(mtu, skb_end_offset(skb));
> skb_reserve(skb, hlen);
> + skb->reserved_tailroom = skb_tailroom(skb) -
> + min_t(int, mtu, skb_tailroom(skb) - tlen);
Are you sure this is correct? Wouldn't that mean (assuming we allocated
enough space), that I could now fill a larger than MTU frame?
> if (__ipv6_get_lladdr(idev, &addr_buf, IFA_F_TENTATIVE)) {
> /* <draft-ietf-magma-mld-source-05.txt>:
Thanks,
Daniel
next prev parent reply other threads:[~2016-02-29 14:57 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-27 19:57 [PATCH] mld, igmp: Fix reserved tailroom calculation Benjamin Poirier
2016-02-29 14:57 ` Daniel Borkmann [this message]
2016-02-29 15:19 ` Benjamin Poirier
2016-02-29 15:38 ` Daniel Borkmann
2016-02-29 15:43 ` Hannes Frederic Sowa
2016-02-29 18:08 ` Benjamin Poirier
2016-02-29 18:28 ` Hannes Frederic Sowa
2016-02-29 23:03 ` [PATCH net v2] " Benjamin Poirier
2016-03-01 10:09 ` Hannes Frederic Sowa
2016-03-01 10:18 ` Daniel Borkmann
2016-03-01 16:00 ` Hannes Frederic Sowa
2016-03-03 20:42 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56D45C6A.5040606@iogearbox.net \
--to=daniel@iogearbox$(echo .)net \
--cc=bpoirier@suse$(echo .)com \
--cc=eric.dumazet@gmail$(echo .)com \
--cc=hannes@stressinduktion$(echo .)org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=yoshfuji@linux-ipv6$(echo .)org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox