Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1481390
| From | kan.liang@intel.com |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [RFC V3 PATCH 25/26] net/netpolicy: limit the total record number |
| Date | 2016-09-12 17:00 +0200 |
| Message-ID | <sgASe-4DC-45@gated-at.bofh.it> (permalink) |
| References | <sgASd-4DC-5@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
From: Kan Liang <kan.liang@intel.com>
NET policy can not fulfill users request without limit, because of the
security consideration and device limitation. For security
consideration, the attacker may fake millions of per task/socket request
to crash the system. For device limitation, the flow director rules
number is limited on i40e driver. NET policy should not run out the
rules, otherwise it cannot guarantee the good performance.
This patch limits the total record number in RCU hash table to fix the
cases as above. The max total record number could vary for different
device. For i40e driver, it limits the record number according to flow
director rules number. If it exceeds the limitation, the registeration
and new object request will be denied.
Since the dev may not be aware in registeration, the cur_rec_num may not
be updated on time. So the actual registered record may exceeds the
max_rec_num. But it will not bring any problems. Because the patch also
check the limitation on object request. It guarantees that the device
resource will not run out.
Signed-off-by: Kan Liang <kan.liang@intel.com>
---
include/linux/netpolicy.h | 4 ++++
net/core/netpolicy.c | 23 +++++++++++++++++++++--
2 files changed, 25 insertions(+), 2 deletions(-)
diff --git a/include/linux/netpolicy.h b/include/linux/netpolicy.h
index 9b03b4d..27fe8e9 100644
--- a/include/linux/netpolicy.h
+++ b/include/linux/netpolicy.h
@@ -40,6 +40,7 @@ enum netpolicy_traffic {
#define NETPOLICY_INVALID_QUEUE -1
#define NETPOLICY_INVALID_LOC NETPOLICY_INVALID_QUEUE
#define POLICY_NAME_LEN_MAX 64
+#define NETPOLICY_MAX_RECORD_NUM 7000
extern const char *policy_name[];
struct netpolicy_dev_info {
@@ -88,6 +89,9 @@ struct netpolicy_info {
struct netpolicy_sys_info sys_info;
/* List of policy objects 0 rx 1 tx */
struct list_head obj_list[NETPOLICY_RXTX][NET_POLICY_MAX];
+ /* for record number limitation */
+ int max_rec_num;
+ atomic_t cur_rec_num;
};
struct netpolicy_tcpudpip4_spec {
diff --git a/net/core/netpolicy.c b/net/core/netpolicy.c
index 84503a4..81afc47 100644
--- a/net/core/netpolicy.c
+++ b/net/core/netpolicy.c
@@ -409,6 +409,9 @@ static int get_avail_queue(struct netpolicy_instance *instance, bool is_rx)
unsigned long ptr_id = (uintptr_t)instance->ptr;
int queue = -1;
+ if (atomic_read(&dev->netpolicy->cur_rec_num) > dev->netpolicy->max_rec_num)
+ return queue;
+
spin_lock_bh(&np_hashtable_lock);
old_record = netpolicy_record_search(ptr_id);
if (!old_record) {
@@ -430,8 +433,10 @@ static int get_avail_queue(struct netpolicy_instance *instance, bool is_rx)
if (is_rx) {
new_record->rx_obj = get_avail_object(dev, new_record->policy,
instance, is_rx);
- if (!new_record->dev)
+ if (!new_record->dev) {
new_record->dev = dev;
+ atomic_inc(&dev->netpolicy->cur_rec_num);
+ }
if (!new_record->rx_obj) {
kfree(new_record);
goto err;
@@ -440,8 +445,10 @@ static int get_avail_queue(struct netpolicy_instance *instance, bool is_rx)
} else {
new_record->tx_obj = get_avail_object(dev, new_record->policy,
instance, is_rx);
- if (!new_record->dev)
+ if (!new_record->dev) {
new_record->dev = dev;
+ atomic_inc(&dev->netpolicy->cur_rec_num);
+ }
if (!new_record->tx_obj) {
kfree(new_record);
goto err;
@@ -685,6 +692,7 @@ int netpolicy_register(struct netpolicy_instance *instance,
enum netpolicy_name policy)
{
unsigned long ptr_id = (uintptr_t)instance->ptr;
+ struct net_device *dev = instance->dev;
struct netpolicy_record *new, *old;
if (!is_net_policy_valid(policy)) {
@@ -692,6 +700,10 @@ int netpolicy_register(struct netpolicy_instance *instance,
return -EINVAL;
}
+ if (dev && dev->netpolicy &&
+ (atomic_read(&dev->netpolicy->cur_rec_num) > dev->netpolicy->max_rec_num))
+ return -ENOSPC;
+
new = kzalloc(sizeof(*new), GFP_KERNEL);
if (!new) {
instance->policy = NET_POLICY_INVALID;
@@ -715,6 +727,8 @@ int netpolicy_register(struct netpolicy_instance *instance,
new->dev = instance->dev;
new->policy = policy;
hash_add_rcu(np_record_hash, &new->hash_node, ptr_id);
+ if (dev && dev->netpolicy)
+ atomic_inc(&dev->netpolicy->cur_rec_num);
}
instance->policy = policy;
spin_unlock_bh(&np_hashtable_lock);
@@ -761,6 +775,8 @@ void netpolicy_unregister(struct netpolicy_instance *instance)
/* The record cannot be share. It can be safely free. */
put_queue(record->dev, record->rx_obj, record->tx_obj);
kfree(record);
+ if (dev && dev->netpolicy)
+ atomic_dec(&dev->netpolicy->cur_rec_num);
}
instance->policy = NET_POLICY_INVALID;
spin_unlock_bh(&np_hashtable_lock);
@@ -1298,6 +1314,9 @@ int init_netpolicy(struct net_device *dev)
goto unlock;
}
+ if (!dev->netpolicy->max_rec_num)
+ dev->netpolicy->max_rec_num = NETPOLICY_MAX_RECORD_NUM;
+
spin_lock(&dev->np_ob_list_lock);
for (i = 0; i < NETPOLICY_RXTX; i++) {
for (j = NET_POLICY_NONE; j < NET_POLICY_MAX; j++)
--
2.5.5
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[RFC V3 PATCH 00/26] Kernel NET policy kan.liang@intel.com - 2016-09-12 17:00 +0200
[RFC V3 PATCH 26/26] Documentation/networking: Document NET policy kan.liang@intel.com - 2016-09-12 17:00 +0200
[RFC V3 PATCH 05/26] net/netpolicy: create CPU and queue mapping kan.liang@intel.com - 2016-09-12 17:00 +0200
[RFC V3 PATCH 22/26] net/netpolicy: set per task policy by proc kan.liang@intel.com - 2016-09-12 17:00 +0200
Re: [RFC V3 PATCH 22/26] net/netpolicy: set per task policy by proc Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> - 2016-09-12 19:10 +0200
[RFC V3 PATCH 08/26] net/netpolicy: introduce NET policy object kan.liang@intel.com - 2016-09-12 17:00 +0200
[RFC V3 PATCH 21/26] net/netpolicy: introduce per task net policy kan.liang@intel.com - 2016-09-12 17:00 +0200
[RFC V3 PATCH 24/26] net/netpolicy: optimize for queue pair kan.liang@intel.com - 2016-09-12 17:00 +0200
[RFC V3 PATCH 20/26] net/netpolicy: set Rx queues according to policy kan.liang@intel.com - 2016-09-12 17:00 +0200
[RFC V3 PATCH 25/26] net/netpolicy: limit the total record number kan.liang@intel.com - 2016-09-12 17:00 +0200
[RFC V3 PATCH 10/26] net/netpolicy: add three new NET policies kan.liang@intel.com - 2016-09-12 17:10 +0200
[RFC V3 PATCH 09/26] net/netpolicy: set NET policy by policy name kan.liang@intel.com - 2016-09-12 17:10 +0200
[RFC V3 PATCH 18/26] net/netpolicy: set tx queues according to policy kan.liang@intel.com - 2016-09-12 17:10 +0200
Re: [RFC V3 PATCH 18/26] net/netpolicy: set tx queues according to policy Tom Herbert <tom@herbertland.com> - 2016-09-12 22:30 +0200
RE: [RFC V3 PATCH 18/26] net/netpolicy: set tx queues according to policy "Liang, Kan" <kan.liang@intel.com> - 2016-09-13 14:30 +0200
[RFC V3 PATCH 02/26] net/netpolicy: init NET policy kan.liang@intel.com - 2016-09-12 17:10 +0200
[RFC V3 PATCH 01/26] net: introduce NET policy kan.liang@intel.com - 2016-09-12 17:10 +0200
[RFC V3 PATCH 14/26] net/netpolicy: handle channel changes kan.liang@intel.com - 2016-09-12 17:10 +0200
[RFC V3 PATCH 13/26] net/netpolicy: support CPU hotplug kan.liang@intel.com - 2016-09-12 17:10 +0200
[RFC V3 PATCH 11/26] net/netpolicy: add MIX policy kan.liang@intel.com - 2016-09-12 17:10 +0200
[RFC V3 PATCH 17/26] net/netpolicy: introduce netpolicy_pick_queue kan.liang@intel.com - 2016-09-12 17:10 +0200
[RFC V3 PATCH 03/26] net/netpolicy: get device queue irq information kan.liang@intel.com - 2016-09-12 17:10 +0200
Re: [RFC V3 PATCH 03/26] net/netpolicy: get device queue irq information Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> - 2016-09-12 18:50 +0200
RE: [RFC V3 PATCH 03/26] net/netpolicy: get device queue irq information "Liang, Kan" <kan.liang@intel.com> - 2016-09-13 14:30 +0200
Re: [RFC V3 PATCH 03/26] net/netpolicy: get device queue irq information Alexander Duyck <alexander.duyck@gmail.com> - 2016-09-13 15:20 +0200
RE: [RFC V3 PATCH 03/26] net/netpolicy: get device queue irq information "Liang, Kan" <kan.liang@intel.com> - 2016-09-13 15:30 +0200
[RFC V3 PATCH 15/26] net/netpolicy: implement netpolicy register kan.liang@intel.com - 2016-09-12 17:10 +0200
[RFC V3 PATCH 19/26] net/netpolicy: tc bpf extension to pick Tx queue kan.liang@intel.com - 2016-09-12 17:10 +0200
[RFC V3 PATCH 12/26] net/netpolicy: NET device hotplug kan.liang@intel.com - 2016-09-12 17:10 +0200
[RFC V3 PATCH 04/26] net/netpolicy: get CPU information kan.liang@intel.com - 2016-09-12 17:10 +0200
Re: [RFC V3 PATCH 00/26] Kernel NET policy Florian Westphal <fw@strlen.de> - 2016-09-12 17:40 +0200
Re: [RFC V3 PATCH 00/26] Kernel NET policy Cong Wang <xiyou.wangcong@gmail.com> - 2016-09-12 19:30 +0200
Re: [RFC V3 PATCH 00/26] Kernel NET policy Eric Dumazet <eric.dumazet@gmail.com> - 2016-09-12 18:00 +0200
Re: [RFC V3 PATCH 00/26] Kernel NET policy Stephen Hemminger <stephen@networkplumber.org> - 2016-09-19 22:40 +0200
csiph-web