diff options
| author | Ben Hutchings <bhutchings@solarflare.com> | 2012-07-30 15:57:00 +0000 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2012-09-19 15:04:46 +0100 |
| commit | 99ea81edff2135603588fe12bd95cca2dd76a5cb (patch) | |
| tree | 20acf0c4b8e799b15b1dd58b75480b211fd3fbce /net/core/dev.c | |
| parent | bc63e39c5809523d365ad0e7f9f7aa8b8ba8fd7c (diff) | |
| download | kernel_samsung_smdk4412-99ea81edff2135603588fe12bd95cca2dd76a5cb.zip kernel_samsung_smdk4412-99ea81edff2135603588fe12bd95cca2dd76a5cb.tar.gz kernel_samsung_smdk4412-99ea81edff2135603588fe12bd95cca2dd76a5cb.tar.bz2 | |
net: Allow driver to limit number of GSO segments per skb
[ Upstream commit 30b678d844af3305cda5953467005cebb5d7b687 ]
A peer (or local user) may cause TCP to use a nominal MSS of as little
as 88 (actual MSS of 76 with timestamps). Given that we have a
sufficiently prodigious local sender and the peer ACKs quickly enough,
it is nevertheless possible to grow the window for such a connection
to the point that we will try to send just under 64K at once. This
results in a single skb that expands to 861 segments.
In some drivers with TSO support, such an skb will require hundreds of
DMA descriptors; a substantial fraction of a TX ring or even more than
a full ring. The TX queue selected for the skb may stall and trigger
the TX watchdog repeatedly (since the problem skb will be retried
after the TX reset). This particularly affects sfc, for which the
issue is designated as CVE-2012-3412.
Therefore:
1. Add the field net_device::gso_max_segs holding the device-specific
limit.
2. In netif_skb_features(), if the number of segments is too high then
mask out GSO features to force fall back to software GSO.
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'net/core/dev.c')
| -rw-r--r-- | net/core/dev.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/core/dev.c b/net/core/dev.c index 4b18703..e6f2635 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -2108,6 +2108,9 @@ u32 netif_skb_features(struct sk_buff *skb) __be16 protocol = skb->protocol; u32 features = skb->dev->features; + if (skb_shinfo(skb)->gso_segs > skb->dev->gso_max_segs) + features &= ~NETIF_F_GSO_MASK; + if (protocol == htons(ETH_P_8021Q)) { struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data; protocol = veh->h_vlan_encapsulated_proto; @@ -5990,6 +5993,7 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name, dev_net_set(dev, &init_net); dev->gso_max_size = GSO_MAX_SIZE; + dev->gso_max_segs = GSO_MAX_SEGS; INIT_LIST_HEAD(&dev->napi_list); INIT_LIST_HEAD(&dev->unreg_list); |