From: Alexander Lobakin <aleksander.lobakin@intel.com>
To: "Gustavo A. R. Silva" <gustavoars@kernel.org>,
Kees Cook <kees@kernel.org>
Cc: <linux-hardening@vger.kernel.org>, <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH v3][next] overflow: Fix direct struct member initialization in _DEFINE_FLEX()
Date: Fri, 30 May 2025 16:59:35 +0200 [thread overview]
Message-ID: <d4eed1e3-6fc0-4372-8ced-ae6a49f3c5c1@intel.com> (raw)
In-Reply-To: <aBQVeyKfLOkO9Yss@kspp>
From: Gustavo A. R. Silva <gustavoars@kernel.org>
Date: Thu, 1 May 2025 18:44:43 -0600
Hey Gustavo, Kees,
> Currently, to statically initialize the struct members of the `type`
> object created by _DEFINE_FLEX(), the internal `obj` member must be
> explicitly referenced at the call site. See:
>
> struct flex {
> int a;
> int b;
> struct foo flex_array[];
> };
>
> _DEFINE_FLEX(struct flex, instance, flex_array,
> FIXED_SIZE, = {
> .obj = {
> .a = 0,
> .b = 1,
> },
> });
>
> This leaks _DEFINE_FLEX() internal implementation details and make
> the helper harder to use and read.
>
> Fix this and allow for a more natural and intuitive C99 init-style:
>
> _DEFINE_FLEX(struct flex, instance, flex_array,
> FIXED_SIZE, = {
> .a = 0,
> .b = 1,
> });
>
> Note that before these changes, the `initializer` argument was optional,
> but now it's required.
Unfortunately this can hurt performance on my setup.
In XDP, we usually place &xdp_buff on the stack. It's 56 bytes. We
initialize it only during the packet processing, not in advance.
In libeth_xdp, see [1], I provide a small extension for this struct.
This extension is 64 byte, plus I added a definition (see
`__LIBETH_XDP_ONSTACK_BUFF()`) to be able to define a bigger one in case
a driver might need more fields there.
The same as with &xdp_buff, it shouldn't be initialized in advance, only
during the packet processing. Otherwise, it can really decrease
performance, you might've seen recent Mellanox report that even
CONFIG_INIT_STACK_ZERO provokes this.
What would be the best option to resolve this? This flex XDP buff on the
stack is fully safe, there are a couple checks that its size does not
exceed the maximum (defined by xdp_buff_xsk) etc. And we really need to
initialize it field-by-field in a loop on a per-packet basis -- we are
sure that there will be no garbage.
It's even worse that most drivers will most likely not want to add any
additional fields, i.e. this flex array at the end will be empty, IOW
they just want a plain libeth_xdp_buff, but I made a unified definition,
with which you can declare them on the stack both with and without
additional fields. So, even if the drivers doesn't want any additional
fields and the flex array is empty, the struct will be zero-initialized
and the same perf hit will apply.
>
> Also, update "counter" member initialization in DEFINE_FLEX().
>
> Fixes: 26dd68d293fd ("overflow: add DEFINE_FLEX() for on-stack allocs")
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
[1]
https://lore.kernel.org/netdev/20250520205920.2134829-9-anthony.l.nguyen@intel.com
Thanks,
Olek
next prev parent reply other threads:[~2025-05-30 15:00 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-05-02 0:44 [PATCH v3][next] overflow: Fix direct struct member initialization in _DEFINE_FLEX() Gustavo A. R. Silva
2025-05-02 2:26 ` Kees Cook
2025-05-30 14:59 ` Alexander Lobakin [this message]
2025-05-30 18:06 ` Kees Cook
2025-05-30 18:52 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d4eed1e3-6fc0-4372-8ced-ae6a49f3c5c1@intel.com \
--to=aleksander.lobakin@intel.com \
--cc=gustavoars@kernel.org \
--cc=kees@kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox