On 12/22/20 1:38 PM, weichenchen wrote:
> pneigh_enqueue() tries to obtain a random delay by mod
> NEIGH_VAR(p, PROXY_DELAY). However, NEIGH_VAR(p, PROXY_DELAY)
> migth be zero at that point because someone could write zero
> to /proc/sys/net/ipv4/neigh/[device]/proxy_delay after the
> callers check it.
>
> This patch makes pneigh_enqueue() get a delay time passed in
> by the callers and the callers guarantee it is not zero.
>
> Signed-off-by: weichenchen <weichen.c...@linux.alibaba.com>
> ---
> V3:
> - Callers need to pass the delay time to pneigh_enqueue()
> now and they should guarantee it is not zero.
> - Use READ_ONCE() to read NEIGH_VAR(p, PROXY_DELAY) in both
> of the existing callers of pneigh_enqueue() and then pass
> it to pneigh_enqueue().
> V2:
> - Use READ_ONCE() to prevent the complier from re-reading
> NEIGH_VAR(p, PROXY_DELAY).
> - Give a hint to the complier that delay <= 0 is unlikely
> to happen.
> ---
> include/net/neighbour.h | 2 +-
> net/core/neighbour.c | 5 ++---
> net/ipv4/arp.c | 8 +++++---
> net/ipv6/ndisc.c | 6 +++---
> 4 files changed, 11 insertions(+), 10 deletions(-)
>
> diff --git a/include/net/neighbour.h b/include/net/neighbour.h
> index 22ced1381ede..f7564dc5304d 100644
> --- a/include/net/neighbour.h
> +++ b/include/net/neighbour.h
> @@ -352,7 +352,7 @@ struct net *neigh_parms_net(const struct neigh_parms
> *parms)
> unsigned long neigh_rand_reach_time(unsigned long base);
>
> void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
> - struct sk_buff *skb);
> + struct sk_buff *skb, int delay);
> struct pneigh_entry *pneigh_lookup(struct neigh_table *tbl, struct net *net,
> const void *key, struct net_device *dev,
> int creat);
> diff --git a/net/core/neighbour.c b/net/core/neighbour.c
> index 9500d28a43b0..b440f966d109 100644
> --- a/net/core/neighbour.c
> +++ b/net/core/neighbour.c
> @@ -1567,12 +1567,11 @@ static void neigh_proxy_process(struct timer_list *t)
> }
>
> void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
> - struct sk_buff *skb)
> + struct sk_buff *skb, int delay)
> {
> unsigned long now = jiffies;
>
> - unsigned long sched_next = now + (prandom_u32() %
> - NEIGH_VAR(p, PROXY_DELAY));
> + unsigned long sched_next = now + (prandom_u32() % delay);
>
> if (tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)) {
> kfree_skb(skb);
This seems rather complex, what about not using a divide in the first place ? :
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index
9500d28a43b0e1a390382912b6fb59db935e727b..745bc89acc87c2a4802fb6f301c11edd2f0096da
100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1569,10 +1569,7 @@ static void neigh_proxy_process(struct timer_list *t)
void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
struct sk_buff *skb)
{
- unsigned long now = jiffies;
-
- unsigned long sched_next = now + (prandom_u32() %
- NEIGH_VAR(p, PROXY_DELAY));
+ unsigned long sched_next = jiffies + prandom_u32_max(NEIGH_VAR(p,
PROXY_DELAY));
if (tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)) {
kfree_skb(skb);
