[PATCH net 1/2] tuntap: correctly linearize skb when zerocopy is used

[PATCH net 1/2] tuntap: correctly linearize skb when zerocopy is used

[Jason Wang]

Userspace may produce vectors greater than MAX_SKB_FRAGS. When we try to
linearize parts of the skb to let the rest of iov to be fit in
the frags, we need count copylen into linear when calling tun_alloc_skb()
instead of partly counting it into data_len. Since this breaks
zerocopy_sg_from_iovec() since its inner counter assumes nr_frags should
be zero at beginning. This cause nr_frags to be increased wrongly without
setting the correct frags.

This bug were introduced from 0690899b4d4501b3505be069b9a687e68ccbe15b
(tun: experimental zero copy tx support)

Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
This patch is needed for stable.
---
 drivers/net/tun.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 7eab5fc..01d5a86 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1109,7 +1109,8 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
 	} else
 		copylen = len;
 
-	skb = tun_alloc_skb(tfile, align, copylen, gso.hdr_len, noblock);
+	skb = tun_alloc_skb(tfile, align, copylen,
+			    zerocopy ? copylen : gso.hdr_len, noblock);
 	if (IS_ERR(skb)) {
 		if (PTR_ERR(skb) != -EAGAIN)
 			tun->dev->stats.rx_dropped++;
-- 
1.7.1

[PATCH net 2/2] macvtap: correctly linearize skb when zerocopy is used

[Jason Wang]

Userspace may produce vectors greater than MAX_SKB_FRAGS. When we try to
linearize parts of the skb to let the rest of iov to be fit in
the frags, we need count copylen into linear when calling macvtap_alloc_skb()
instead of partly counting it into data_len. Since this breaks
zerocopy_sg_from_iovec() since its inner counter assumes nr_frags should
be zero at beginning. This cause nr_frags to be increased wrongly without
setting the correct frags.

This bug were introduced from b92946e2919134ebe2a4083e4302236295ea2a73
(macvtap: zerocopy: validate vectors before building skb).

Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
This patch is needed for stable.
---
 drivers/net/macvtap.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index f2c4a3b..b213020 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -770,7 +770,8 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
 		copylen = len;
 
 	skb = macvtap_alloc_skb(&q->sk, NET_IP_ALIGN, copylen,
-				vnet_hdr.hdr_len, noblock, &err);
+				zerocopy ? copylen : vnet_hdr.hdr_len,
+				noblock, &err);
 	if (!skb)
 		goto err;
 
-- 
1.7.1

Re: [PATCH net 2/2] macvtap: correctly linearize skb when zerocopy is used

[Michael S. Tsirkin]

On Tue, Jul 09, 2013 at 06:10:51PM +0800, Jason Wang wrote:
> Userspace may produce vectors greater than MAX_SKB_FRAGS. When we try to
> linearize parts of the skb to let the rest of iov to be fit in
> the frags, we need count copylen into linear when calling macvtap_alloc_skb()
> instead of partly counting it into data_len. Since this breaks
> zerocopy_sg_from_iovec() since its inner counter assumes nr_frags should
> be zero at beginning. This cause nr_frags to be increased wrongly without
> setting the correct frags.
> 
> This bug were introduced from b92946e2919134ebe2a4083e4302236295ea2a73
> (macvtap: zerocopy: validate vectors before building skb).
> 
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Signed-off-by: Jason Wang <jasowang@redhat.com>
> ---
> This patch is needed for stable.
> ---
>  drivers/net/macvtap.c |    3 ++-
>  1 files changed, 2 insertions(+), 1 deletions(-)
> 
> diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
> index f2c4a3b..b213020 100644
> --- a/drivers/net/macvtap.c
> +++ b/drivers/net/macvtap.c
> @@ -770,7 +770,8 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
>  		copylen = len;
>  
>  	skb = macvtap_alloc_skb(&q->sk, NET_IP_ALIGN, copylen,
> -				vnet_hdr.hdr_len, noblock, &err);
> +				zerocopy ? copylen : vnet_hdr.hdr_len,
> +				noblock, &err);
>  	if (!skb)
>  		goto err;

Same comment as for tun - let's add code for the if statement above.
Thanks!

> -- 
> 1.7.1

Re: [PATCH net 2/2] macvtap: correctly linearize skb when zerocopy is used

[Jason Wang]

On 07/09/2013 06:35 PM, Michael S. Tsirkin wrote:
> On Tue, Jul 09, 2013 at 06:10:51PM +0800, Jason Wang wrote:
>> Userspace may produce vectors greater than MAX_SKB_FRAGS. When we try to
>> linearize parts of the skb to let the rest of iov to be fit in
>> the frags, we need count copylen into linear when calling macvtap_alloc_skb()
>> instead of partly counting it into data_len. Since this breaks
>> zerocopy_sg_from_iovec() since its inner counter assumes nr_frags should
>> be zero at beginning. This cause nr_frags to be increased wrongly without
>> setting the correct frags.
>>
>> This bug were introduced from b92946e2919134ebe2a4083e4302236295ea2a73
>> (macvtap: zerocopy: validate vectors before building skb).
>>
>> Cc: Michael S. Tsirkin <mst@redhat.com>
>> Signed-off-by: Jason Wang <jasowang@redhat.com>
>> ---
>> This patch is needed for stable.
>> ---
>>  drivers/net/macvtap.c |    3 ++-
>>  1 files changed, 2 insertions(+), 1 deletions(-)
>>
>> diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
>> index f2c4a3b..b213020 100644
>> --- a/drivers/net/macvtap.c
>> +++ b/drivers/net/macvtap.c
>> @@ -770,7 +770,8 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
>>  		copylen = len;
>>  
>>  	skb = macvtap_alloc_skb(&q->sk, NET_IP_ALIGN, copylen,
>> -				vnet_hdr.hdr_len, noblock, &err);
>> +				zerocopy ? copylen : vnet_hdr.hdr_len,
>> +				noblock, &err);
>>  	if (!skb)
>>  		goto err;
> Same comment as for tun - let's add code for the if statement above.
> Thanks!
>

Sure, I will post v2.

Thanks
>> -- 
>> 1.7.1
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH net 1/2] tuntap: correctly linearize skb when zerocopy is used

[Michael S. Tsirkin]

On Tue, Jul 09, 2013 at 06:10:50PM +0800, Jason Wang wrote:
> Userspace may produce vectors greater than MAX_SKB_FRAGS. When we try to
> linearize parts of the skb to let the rest of iov to be fit in
> the frags, we need count copylen into linear when calling tun_alloc_skb()
> instead of partly counting it into data_len. Since this breaks
> zerocopy_sg_from_iovec() since its inner counter assumes nr_frags should
> be zero at beginning. This cause nr_frags to be increased wrongly without
> setting the correct frags.
> 
> This bug were introduced from 0690899b4d4501b3505be069b9a687e68ccbe15b
> (tun: experimental zero copy tx support)
> 
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Signed-off-by: Jason Wang <jasowang@redhat.com>
> ---
> This patch is needed for stable.
> ---
>  drivers/net/tun.c |    3 ++-
>  1 files changed, 2 insertions(+), 1 deletions(-)
> 
> diff --git a/drivers/net/tun.c b/drivers/net/tun.c
> index 7eab5fc..01d5a86 100644
> --- a/drivers/net/tun.c
> +++ b/drivers/net/tun.c
> @@ -1109,7 +1109,8 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
>  	} else
>  		copylen = len;
>  
> -	skb = tun_alloc_skb(tfile, align, copylen, gso.hdr_len, noblock);
> +	skb = tun_alloc_skb(tfile, align, copylen,
> +			    zerocopy ? copylen : gso.hdr_len, noblock);
>  	if (IS_ERR(skb)) {
>  		if (PTR_ERR(skb) != -EAGAIN)
>  			tun->dev->stats.rx_dropped++;

Good catch, thanks. But let's add a new variable and
set it in the if statement above
instead of an extra branch here - not for performance but
because it's clearer this way.

> -- 
> 1.7.1