| Message ID | 20201001075408.25508-1-colyli@suse.de |
|---|---|
| Headers | show |
| Series | Introduce sendpage_ok() to detect misused sendpage in network related drivers | expand |
On 10/1/20 12:54 AM, Coly Li wrote: > In iscsci driver, iscsi_tcp_segment_map() uses the following code to > check whether the page should or not be handled by sendpage: > if (!recv && page_count(sg_page(sg)) >= 1 && !PageSlab(sg_page(sg))) > > The "page_count(sg_page(sg)) >= 1 && !PageSlab(sg_page(sg)" part is to > make sure the page can be sent to network layer's zero copy path. This > part is exactly what sendpage_ok() does. > > This patch uses use sendpage_ok() in iscsi_tcp_segment_map() to replace > the original open coded checks. > > Signed-off-by: Coly Li <colyli@suse.de> > Acked-by: Martin K. Petersen <martin.petersen@oracle.com> > Cc: Vasily Averin <vvs@virtuozzo.com> > Cc: Cong Wang <amwang@redhat.com> > Cc: Mike Christie <michaelc@cs.wisc.edu> > Cc: Lee Duncan <lduncan@suse.com> > Cc: Chris Leech <cleech@redhat.com> > Cc: Christoph Hellwig <hch@lst.de> > Cc: Hannes Reinecke <hare@suse.de> > --- > drivers/scsi/libiscsi_tcp.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/scsi/libiscsi_tcp.c b/drivers/scsi/libiscsi_tcp.c > index 37e5d4e48c2f..83f14b2c8804 100644 > --- a/drivers/scsi/libiscsi_tcp.c > +++ b/drivers/scsi/libiscsi_tcp.c > @@ -128,7 +128,7 @@ static void iscsi_tcp_segment_map(struct iscsi_segment *segment, int recv) > * coalescing neighboring slab objects into a single frag which > * triggers one of hardened usercopy checks. > */ > - if (!recv && page_count(sg_page(sg)) >= 1 && !PageSlab(sg_page(sg))) > + if (!recv && sendpage_ok(sg_page(sg))) > return; > > if (recv) { > Reviewed-by: Lee Duncan <lduncan@suse.com>
From: Coly Li <colyli@suse.de> Date: Thu, 1 Oct 2020 15:54:01 +0800 > This series was original by a bug fix in nvme-over-tcp driver which only > checked whether a page was allocated from slab allcoator, but forgot to > check its page_count: The page handled by sendpage should be neither a > Slab page nor 0 page_count page. > > As Sagi Grimberg suggested, the original fix is refind to a more common > inline routine: > static inline bool sendpage_ok(struct page *page) > { > return (!PageSlab(page) && page_count(page) >= 1); > } > If sendpage_ok() returns true, the checking page can be handled by the > concrete zero-copy sendpage method in network layer. > > The v9 series has 7 patches, no change from v8 series, > - The 1st patch in this series introduces sendpage_ok() in header file > include/linux/net.h. > - The 2nd patch adds WARN_ONCE() for improper zero-copy send in > kernel_sendpage(). > - The 3rd patch fixes the page checking issue in nvme-over-tcp driver. > - The 4th patch adds page_count check by using sendpage_ok() in > do_tcp_sendpages() as Eric Dumazet suggested. > - The 5th and 6th patches just replace existing open coded checks with ... Series applied and queued up for -stable, thank you.
From: David Miller <davem@davemloft.net> Date: Thu, 01 Oct 2020 12:43:45 -0700 (PDT) > Series applied and queued up for -stable, thank you. Actually, this doesn't even build: In file included from ./arch/x86/include/asm/bug.h:93, from ./include/linux/bug.h:5, from ./include/linux/mmdebug.h:5, from ./include/linux/mm.h:9, from net/socket.c:55: net/socket.c: In function ‘kernel_sendpage’: ./include/asm-generic/bug.h:97:3: error: too few arguments to function ‘__warn_printk’ 97 | __warn_printk(arg); \ | ^~~~~~~~~~~~~ Was this even build tested?
On 2020/10/2 03:48, David Miller wrote: > From: David Miller <davem@davemloft.net> > Date: Thu, 01 Oct 2020 12:43:45 -0700 (PDT) > >> Series applied and queued up for -stable, thank you. > > Actually, this doesn't even build: > > In file included from ./arch/x86/include/asm/bug.h:93, > from ./include/linux/bug.h:5, > from ./include/linux/mmdebug.h:5, > from ./include/linux/mm.h:9, > from net/socket.c:55: > net/socket.c: In function ‘kernel_sendpage’: > ./include/asm-generic/bug.h:97:3: error: too few arguments to function ‘__warn_printk’ > 97 | __warn_printk(arg); \ > | ^~~~~~~~~~~~~ > > Was this even build tested? > Hi David, Obviously my fault and no excuse for leaking this uncompleted version to you. I just re-post a v10 version which I make sure all patches are the latest version. Sorry for the inconvenience and thank you in advance for taking this set. Coly Li
From: Coly Li <colyli@suse.de> Date: Fri, 2 Oct 2020 16:30:12 +0800 > Obviously my fault and no excuse for leaking this uncompleted version to > you. I just re-post a v10 version which I make sure all patches are the > latest version. > > Sorry for the inconvenience and thank you in advance for taking this set. How did this happen? How did you functionally test the patch set if it didn't even compile? I want you to explain why you sent a completely untested patch set.
This series was original by a bug fix in nvme-over-tcp driver which only checked whether a page was allocated from slab allcoator, but forgot to check its page_count: The page handled by sendpage should be neither a Slab page nor 0 page_count page. As Sagi Grimberg suggested, the original fix is refind to a more common inline routine: static inline bool sendpage_ok(struct page *page) { return (!PageSlab(page) && page_count(page) >= 1); } If sendpage_ok() returns true, the checking page can be handled by the concrete zero-copy sendpage method in network layer. The v9 series has 7 patches, no change from v8 series, - The 1st patch in this series introduces sendpage_ok() in header file include/linux/net.h. - The 2nd patch adds WARN_ONCE() for improper zero-copy send in kernel_sendpage(). - The 3rd patch fixes the page checking issue in nvme-over-tcp driver. - The 4th patch adds page_count check by using sendpage_ok() in do_tcp_sendpages() as Eric Dumazet suggested. - The 5th and 6th patches just replace existing open coded checks with the inline sendpage_ok() routine. Coly Li Cc: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com> Cc: Chris Leech <cleech@redhat.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Cong Wang <amwang@redhat.com> Cc: David S. Miller <davem@davemloft.net> Cc: Eric Dumazet <eric.dumazet@gmail.com> Cc: Hannes Reinecke <hare@suse.de> Cc: Ilya Dryomov <idryomov@gmail.com> Cc: Jan Kara <jack@suse.com> Cc: Jeff Layton <jlayton@kernel.org> Cc: Jens Axboe <axboe@kernel.dk> Cc: Lee Duncan <lduncan@suse.com> Cc: Mike Christie <michaelc@cs.wisc.edu> Cc: Mikhail Skorzhinskii <mskorzhinskiy@solarflare.com> Cc: Philipp Reisner <philipp.reisner@linbit.com> Cc: Sagi Grimberg <sagi@grimberg.me> Cc: Vasily Averin <vvs@virtuozzo.com> Cc: Vlastimil Babka <vbabka@suse.com> --- Changelog: v9, fix a typo pointed out by Greg KH. add Acked-by tags from Martin K. Petersen and Ilya Dryomov. v8: add WARN_ONCE() in kernel_sendpage() as Christoph suggested. v7: remove outer brackets from the return line of sendpage_ok() as Eric Dumazet suggested. v6: fix page check in do_tcp_sendpages(), as Eric Dumazet suggested. replace other open coded checks with sendpage_ok() in libceph, iscsi drivers. v5, include linux/mm.h in include/linux/net.h v4, change sendpage_ok() as an inline helper, and post it as separate patch, as Christoph Hellwig suggested. v3, introduce a more common sendpage_ok() as Sagi Grimberg suggested. v2, fix typo in patch subject v1, the initial version. Coly Li (7): net: introduce helper sendpage_ok() in include/linux/net.h net: add WARN_ONCE in kernel_sendpage() for improper zero-copy send nvme-tcp: check page by sendpage_ok() before calling kernel_sendpage() tcp: use sendpage_ok() to detect misused .sendpage drbd: code cleanup by using sendpage_ok() to check page for kernel_sendpage() scsi: libiscsi: use sendpage_ok() in iscsi_tcp_segment_map() libceph: use sendpage_ok() in ceph_tcp_sendpage() drivers/block/drbd/drbd_main.c | 2 +- drivers/nvme/host/tcp.c | 7 +++---- drivers/scsi/libiscsi_tcp.c | 2 +- include/linux/net.h | 16 ++++++++++++++++ net/ceph/messenger.c | 2 +- net/ipv4/tcp.c | 3 ++- net/socket.c | 6 ++++-- 7 files changed, 28 insertions(+), 10 deletions(-)