From patchwork Fri May 16 11:08:16 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wei Liu X-Patchwork-Id: 349572 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 444E5140087 for ; Fri, 16 May 2014 21:08:23 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756979AbaEPLIT (ORCPT ); Fri, 16 May 2014 07:08:19 -0400 Received: from smtp02.citrix.com ([66.165.176.63]:32711 "EHLO SMTP02.CITRIX.COM" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756870AbaEPLIS (ORCPT ); Fri, 16 May 2014 07:08:18 -0400 X-IronPort-AV: E=Sophos;i="4.97,1066,1389744000"; d="scan'208";a="131112970" Received: from accessns.citrite.net (HELO FTLPEX01CL03.citrite.net) ([10.9.154.239]) by FTLPIPO02.CITRIX.COM with ESMTP; 16 May 2014 11:08:18 +0000 Received: from ukmail1.uk.xensource.com (10.80.16.128) by smtprelay.citrix.com (10.13.107.80) with Microsoft SMTP Server id 14.3.181.6; Fri, 16 May 2014 07:08:17 -0400 Received: from dt47.uk.xensource.com ([10.80.229.47] helo=dt47.uk.xensource.com.) by ukmail1.uk.xensource.com with esmtp (Exim 4.69) (envelope-from ) id 1WlFzt-0006PO-2n; Fri, 16 May 2014 12:08:17 +0100 From: Wei Liu To: , CC: Wei Liu , David Vrabel , Konrad Wilk , Boris Ostrovsky , Stefan Bader , Zoltan Kiss Subject: [PATCH net-next] xen-netfront: try linearizing SKB if it occupies too many slots Date: Fri, 16 May 2014 12:08:16 +0100 Message-ID: <1400238496-2471-1-git-send-email-wei.liu2@citrix.com> X-Mailer: git-send-email 1.7.10.4 MIME-Version: 1.0 X-DLP: MIA1 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Some workload, such as Redis can generate SKBs which make use of compound pages. Netfront doesn't quite like that because it doesn't want to send packet that occupies exessive slots to the backend as backend might deem it malicious. On the flip side these packets are actually legit, the size check at the beginning of xennet_start_xmit ensures that packet size is below 64K. So we linearize SKB if it occupies too many slots. If the linearization fails then the SKB is dropped. Signed-off-by: Wei Liu Cc: David Vrabel Cc: Konrad Wilk Cc: Boris Ostrovsky Cc: Stefan Bader Cc: Zoltan Kiss --- drivers/net/xen-netfront.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c index 895355d..b378dcd 100644 --- a/drivers/net/xen-netfront.c +++ b/drivers/net/xen-netfront.c @@ -573,9 +573,20 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev) slots = DIV_ROUND_UP(offset + len, PAGE_SIZE) + xennet_count_skb_frag_slots(skb); if (unlikely(slots > MAX_SKB_FRAGS + 1)) { - net_alert_ratelimited( - "xennet: skb rides the rocket: %d slots\n", slots); - goto drop; + if (skb_linearize(skb)) { + net_alert_ratelimited( + "xennet: failed to linearize skb, skb dropped\n"); + goto drop; + } + data = skb->data; + offset = offset_in_page(data); + len = skb_headlen(skb); + slots = DIV_ROUND_UP(offset + len, PAGE_SIZE); + if (unlikely(slots > MAX_SKB_FRAGS + 1)) { + net_alert_ratelimited( + "xennet: still too many slots after linerization: %d", slots); + goto drop; + } } spin_lock_irqsave(&np->tx_lock, flags);