On Wed, 2018-02-14 at 13:50 +0100, Jon Maloy wrote: > A received sk buffer may contain dozens of smaller 'bundled' messages > which after extraction go each in their own direction. > > Unfortunately, when we extract those messages using skb_clone() each > of the extracted buffers inherit the truesize value of the original > buffer. Apart from causing massive overaccounting of the base buffer's > memory, this often causes tipc_msg_validate() to come to the false > conclusion that the ratio truesize/datasize > 4, and perform an > unnecessary copying of the extracted buffer. > > We now fix this problem by explicitly correcting the truesize value of > the buffer clones to be the truesize of the clone itself. This change > eliminates both the overaccounting and the unnecessary buffer copying. > > Reported-by: Hoang Le <hoang.h...@dektek.com.au> > Acked-by: Ying Xue <ying....@windriver.com> > Signed-off-by: Jon Maloy <jon.ma...@ericsson.com> > --- > net/tipc/msg.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/net/tipc/msg.c b/net/tipc/msg.c > index 4e1c6f6..a368fa8 100644 > --- a/net/tipc/msg.c > +++ b/net/tipc/msg.c > @@ -434,6 +434,9 @@ bool tipc_msg_extract(struct sk_buff *skb, struct sk_buff > **iskb, int *pos) > skb_pull(*iskb, offset); > imsz = msg_size(buf_msg(*iskb)); > skb_trim(*iskb, imsz); > + > + /* Scale extracted buffer's truesize to avoid double accounting */ > + (*iskb)->truesize = SKB_TRUESIZE(imsz);
How do you guarantee that under accounting wont happen here ? Copying data to avoid OOM is not necessarily bad. TCP stack does this under stress (this is called collapsing), and this definitely can happen. skb_clone() will also clones frags, and you absolutely do not know what memory each frag can hold (that could be 64KB on arches with 64KB pages)
