From: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>
To: netdev@vger.kernel.org
Cc: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Daniel Borkmann <daniel@iogearbox.net>,
David Ahern <dsahern@kernel.org>,
Yajun Deng <yajun.deng@linux.dev>,
Roopa Prabhu <roopa@nvidia.com>,
Christian Brauner <brauner@kernel.org>,
linux-kernel@vger.kernel.org,
Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>,
Konstantin Khorenko <khorenko@virtuozzo.com>,
kernel@openvz.org, devel@openvz.org,
"Denis V . Lunev" <den@openvz.org>
Subject: [PATCH v3 2/2] neighbour: make proxy_queue.qlen limit per-device
Date: Thu, 11 Aug 2022 18:20:12 +0300 [thread overview]
Message-ID: <20220811152012.319641-3-alexander.mikhalitsyn@virtuozzo.com> (raw)
In-Reply-To: <20220811152012.319641-1-alexander.mikhalitsyn@virtuozzo.com>
Right now we have a neigh_param PROXY_QLEN which specifies maximum length
of neigh_table->proxy_queue. But in fact, this limitation doesn't work well
because check condition looks like:
tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)
The problem is that p (struct neigh_parms) is a per-device thing,
but tbl (struct neigh_table) is a system-wide global thing.
It seems reasonable to make proxy_queue limit per-device based.
v2:
- nothing changed in this patch
v3:
- rebase to net tree
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: David Ahern <dsahern@kernel.org>
Cc: Yajun Deng <yajun.deng@linux.dev>
Cc: Roopa Prabhu <roopa@nvidia.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Cc: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>
Cc: Konstantin Khorenko <khorenko@virtuozzo.com>
Cc: kernel@openvz.org
Cc: devel@openvz.org
Suggested-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>
Reviewed-by: Denis V. Lunev <den@openvz.org>
---
include/net/neighbour.h | 1 +
net/core/neighbour.c | 25 ++++++++++++++++++++++---
2 files changed, 23 insertions(+), 3 deletions(-)
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index 9f0bab0589d9..3827a6b395fd 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -83,6 +83,7 @@ struct neigh_parms {
struct rcu_head rcu_head;
int reachable_time;
+ int qlen;
int data[NEIGH_VAR_DATA_MAX];
DECLARE_BITMAP(data_state, NEIGH_VAR_DATA_MAX);
};
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 0e38a05d5b23..5b669eb80270 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -316,9 +316,18 @@ static void pneigh_queue_purge(struct sk_buff_head *list, struct net *net)
skb = skb_peek(list);
while (skb != NULL) {
struct sk_buff *skb_next = skb_peek_next(skb, list);
- if (net == NULL || net_eq(dev_net(skb->dev), net)) {
+ struct net_device *dev = skb->dev;
+ if (net == NULL || net_eq(dev_net(dev), net)) {
+ struct in_device *in_dev;
+
+ rcu_read_lock();
+ in_dev = __in_dev_get_rcu(dev);
+ if (in_dev)
+ in_dev->arp_parms->qlen--;
+ rcu_read_unlock();
__skb_unlink(skb, list);
- dev_put(skb->dev);
+
+ dev_put(dev);
kfree_skb(skb);
}
skb = skb_next;
@@ -1606,8 +1615,15 @@ static void neigh_proxy_process(struct timer_list *t)
if (tdif <= 0) {
struct net_device *dev = skb->dev;
+ struct in_device *in_dev;
+ rcu_read_lock();
+ in_dev = __in_dev_get_rcu(dev);
+ if (in_dev)
+ in_dev->arp_parms->qlen--;
+ rcu_read_unlock();
__skb_unlink(skb, &tbl->proxy_queue);
+
if (tbl->proxy_redo && netif_running(dev)) {
rcu_read_lock();
tbl->proxy_redo(skb);
@@ -1632,7 +1648,7 @@ void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
unsigned long sched_next = jiffies +
prandom_u32_max(NEIGH_VAR(p, PROXY_DELAY));
- if (tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)) {
+ if (p->qlen > NEIGH_VAR(p, PROXY_QLEN)) {
kfree_skb(skb);
return;
}
@@ -1648,6 +1664,7 @@ void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
skb_dst_drop(skb);
dev_hold(skb->dev);
__skb_queue_tail(&tbl->proxy_queue, skb);
+ p->qlen++;
mod_timer(&tbl->proxy_timer, sched_next);
spin_unlock(&tbl->proxy_queue.lock);
}
@@ -1680,6 +1697,7 @@ struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
refcount_set(&p->refcnt, 1);
p->reachable_time =
neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
+ p->qlen = 0;
netdev_hold(dev, &p->dev_tracker, GFP_KERNEL);
p->dev = dev;
write_pnet(&p->net, net);
@@ -1745,6 +1763,7 @@ void neigh_table_init(int index, struct neigh_table *tbl)
refcount_set(&tbl->parms.refcnt, 1);
tbl->parms.reachable_time =
neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
+ tbl->parms.qlen = 0;
tbl->stats = alloc_percpu(struct neigh_statistics);
if (!tbl->stats)
--
2.36.1
next prev parent reply other threads:[~2022-08-11 15:21 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-29 10:35 [PATCH 0/2] neighbour: fix possible DoS due to net iface start/stop loop Alexander Mikhalitsyn
2022-07-29 10:35 ` [PATCH 1/2] neigh: " Alexander Mikhalitsyn
2022-08-01 15:08 ` David Ahern
2022-08-01 15:44 ` Denis V. Lunev
2022-07-29 10:35 ` [PATCH 2/2] neighbour: make proxy_queue.qlen limit per-device Alexander Mikhalitsyn
2022-08-10 16:08 ` [PATCH v2 0/2] neighbour: fix possible DoS due to net iface start/stop loop Alexander Mikhalitsyn
2022-08-10 16:08 ` [PATCH v2 1/2] neigh: " Alexander Mikhalitsyn
2022-08-15 9:44 ` Christian Brauner
2022-08-15 10:47 ` Denis V. Lunev
2022-08-10 16:08 ` [PATCH v2 2/2] neighbour: make proxy_queue.qlen limit per-device Alexander Mikhalitsyn
2022-08-11 14:46 ` [PATCH v2 0/2] neighbour: fix possible DoS due to net iface start/stop loop Jakub Kicinski
2022-08-11 14:51 ` Alexander Mikhalitsyn
2022-08-11 14:53 ` Jakub Kicinski
2022-08-11 14:57 ` Alexander Mikhalitsyn
2022-08-11 15:20 ` [PATCH v3 " Alexander Mikhalitsyn
2022-08-11 15:20 ` [PATCH v3 1/2] neigh: " Alexander Mikhalitsyn
2022-08-11 15:20 ` Alexander Mikhalitsyn [this message]
2022-08-15 10:40 ` [PATCH v3 0/2] neighbour: " patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220811152012.319641-3-alexander.mikhalitsyn@virtuozzo.com \
--to=alexander.mikhalitsyn@virtuozzo.com \
--cc=brauner@kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=den@openvz.org \
--cc=devel@openvz.org \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=kernel@openvz.org \
--cc=khorenko@virtuozzo.com \
--cc=kuba@kernel.org \
--cc=kuznet@ms2.inr.ac.ru \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=roopa@nvidia.com \
--cc=yajun.deng@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®