Re: [PATCH 5.4 175/244] inet: use bigger hash table for IP ID generation

[Amit Klein <aksecurity@xxxxxxxxx>]

Here is the patch (minus headers, description, etc. - I believe these
can be copied as is from the 5.x patch, but not sure about the
rules...). It can be applied to 4.14.236. If this is OK, I can move on
to 4.9 and 4.4.


 net/ipv4/route.c | 41 ++++++++++++++++++++++++++++-------------
 1 file changed, 28 insertions(+), 13 deletions(-)

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 78d6bc61a1d8..022a2b748da3 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -70,6 +70,7 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
+#include <linux/memblock.h>
 #include <linux/string.h>
 #include <linux/socket.h>
 #include <linux/sockios.h>
@@ -485,8 +486,10 @@ static void ipv4_confirm_neigh(const struct
dst_entry *dst, const void *daddr)
     __ipv4_confirm_neigh(dev, *(__force u32 *)pkey);
 }

-#define IP_IDENTS_SZ 2048u
-
+/* Hash tables of size 2048..262144 depending on RAM size.
+ * Each bucket uses 8 bytes.
+ */
+static u32 ip_idents_mask __read_mostly;
 static atomic_t *ip_idents __read_mostly;
 static u32 *ip_tstamps __read_mostly;

@@ -496,12 +499,16 @@ static u32 *ip_tstamps __read_mostly;
  */
 u32 ip_idents_reserve(u32 hash, int segs)
 {
-    u32 *p_tstamp = ip_tstamps + hash % IP_IDENTS_SZ;
-    atomic_t *p_id = ip_idents + hash % IP_IDENTS_SZ;
-    u32 old = ACCESS_ONCE(*p_tstamp);
-    u32 now = (u32)jiffies;
+    u32 bucket, old, now = (u32)jiffies;
+    atomic_t *p_id;
+    u32 *p_tstamp;
     u32 delta = 0;

+    bucket = hash & ip_idents_mask;
+    p_tstamp = ip_tstamps + bucket;
+    p_id = ip_idents + bucket;
+    old = READ_ONCE(*p_tstamp);
+
     if (old != now && cmpxchg(p_tstamp, old, now) == old)
         delta = prandom_u32_max(now - old);

@@ -3099,17 +3106,25 @@ struct ip_rt_acct __percpu *ip_rt_acct __read_mostly;
 int __init ip_rt_init(void)
 {
     int rc = 0;
+    void *idents_hash;
     int cpu;

-    ip_idents = kmalloc(IP_IDENTS_SZ * sizeof(*ip_idents), GFP_KERNEL);
-    if (!ip_idents)
-        panic("IP: failed to allocate ip_idents\n");
+    /* For modern hosts, this will use 2 MB of memory */
+    idents_hash = alloc_large_system_hash("IP idents",
+                          sizeof(*ip_idents) + sizeof(*ip_tstamps),
+                          0,
+                          16, /* one bucket per 64 KB */
+                          HASH_ZERO,
+                          NULL,
+                          &ip_idents_mask,
+                          2048,
+                          256*1024);
+
+    ip_idents = idents_hash;

-    prandom_bytes(ip_idents, IP_IDENTS_SZ * sizeof(*ip_idents));
+    prandom_bytes(ip_idents, (ip_idents_mask + 1) * sizeof(*ip_idents));

-    ip_tstamps = kcalloc(IP_IDENTS_SZ, sizeof(*ip_tstamps), GFP_KERNEL);
-    if (!ip_tstamps)
-        panic("IP: failed to allocate ip_tstamps\n");
+    ip_tstamps = idents_hash + (ip_idents_mask + 1) * sizeof(*ip_idents);

     for_each_possible_cpu(cpu) {
         struct uncached_list *ul = &per_cpu(rt_uncached_list, cpu);

On Wed, Jun 16, 2021 at 10:16 AM Greg Kroah-Hartman
<gregkh@xxxxxxxxxxxxxxxxxxx> wrote:
>
> On Wed, Jun 16, 2021 at 10:02:44AM +0300, Amit Klein wrote:
> >  Hi Greg et al.
> >
> > I see that you backported this patch (increasing the IP ID hash table size)
> > to the newer LTS branches more than a month ago. But I don't see that it
> > was backported to older LTS branches (4.19, 4.14, 4.9, 4.4). Is this
> > intentional?
>
> It applies cleanly to 4.19, but not the older ones.  If you think it is
> needed there for those kernels, please provide a working backport that
> we can apply.
>
> thanks,
>
> greg k-h