* test
@ 2002-11-07 13:54 Jacky Hsiao
0 siblings, 0 replies; 10+ messages in thread
From: Jacky Hsiao @ 2002-11-07 13:54 UTC (permalink / raw)
To: netdev
^ permalink raw reply [flat|nested] 10+ messages in thread
* test
@ 2005-05-05 18:30 Vlad Yasevich
0 siblings, 0 replies; 10+ messages in thread
From: Vlad Yasevich @ 2005-05-05 18:30 UTC (permalink / raw)
To: netdev
^ permalink raw reply [flat|nested] 10+ messages in thread
* test
@ 2009-11-04 20:27 Simon Kirby
2009-11-05 9:26 ` test Julian Anastasov
0 siblings, 1 reply; 10+ messages in thread
From: Simon Kirby @ 2009-11-04 20:27 UTC (permalink / raw)
To: netdev, Wensong Zhang, Julian Anastasov
[-- Attachment #1: Type: text/plain, Size: 1191 bytes --]
Hello!
I was noticing a significant amount of what seems/seemed to be
destination lists with multiple entries with the lblcr LVS algorithm.
While tracking it down, I think I stumbled over a mistake. In
ip_vs_lblcr_full_check(), it appears the time check logic is reversed:
for (i=0, j=tbl->rover; i<IP_VS_LBLCR_TAB_SIZE; i++) {
j = (j + 1) & IP_VS_LBLCR_TAB_MASK;
write_lock(&svc->sched_lock);
list_for_each_entry_safe(en, nxt, &tbl->bucket[j], list) {
if (time_after(en->lastuse+sysctl_ip_vs_lblcr_expiration,
now))
continue;
ip_vs_lblcr_free(en);
atomic_dec(&tbl->entries);
}
write_unlock(&svc->sched_lock);
}
Shouldn't this be "time_before"? It seems that it currently nukes all
recently-used entries every time this function is called, which seems to
be every 30 minutes, rather than removing the not-recently-used ones.
If my reading is correct, this patch should fix it. Am I missing
something?
Cheers,
Simon-
[-- Attachment #2: lblcr+full_check_time_fix.patch --]
[-- Type: text/x-diff, Size: 535 bytes --]
diff --git a/net/netfilter/ipvs/ip_vs_lblcr.c b/net/netfilter/ipvs/ip_vs_lblcr.c
index 715b57f..937743f 100644
--- a/net/netfilter/ipvs/ip_vs_lblcr.c
+++ b/net/netfilter/ipvs/ip_vs_lblcr.c
@@ -432,7 +432,7 @@ static inline void ip_vs_lblcr_full_check(struct ip_vs_service *svc)
write_lock(&svc->sched_lock);
list_for_each_entry_safe(en, nxt, &tbl->bucket[j], list) {
- if (time_after(en->lastuse+sysctl_ip_vs_lblcr_expiration,
+ if (time_before(en->lastuse+sysctl_ip_vs_lblcr_expiration,
now))
continue;
^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: test
2009-11-04 20:27 test Simon Kirby
@ 2009-11-05 9:26 ` Julian Anastasov
2009-11-05 10:11 ` test Simon Kirby
0 siblings, 1 reply; 10+ messages in thread
From: Julian Anastasov @ 2009-11-05 9:26 UTC (permalink / raw)
To: Simon Kirby; +Cc: netdev, Wensong Zhang
Hello,
On Wed, 4 Nov 2009, Simon Kirby wrote:
> Hello!
>
> I was noticing a significant amount of what seems/seemed to be
> destination lists with multiple entries with the lblcr LVS algorithm.
> While tracking it down, I think I stumbled over a mistake. In
> ip_vs_lblcr_full_check(), it appears the time check logic is reversed:
>
> for (i=0, j=tbl->rover; i<IP_VS_LBLCR_TAB_SIZE; i++) {
> j = (j + 1) & IP_VS_LBLCR_TAB_MASK;
>
> write_lock(&svc->sched_lock);
> list_for_each_entry_safe(en, nxt, &tbl->bucket[j], list) {
If 'time to expire' is after current time then continue,
i.e. current time didn't reached the limit, seems correct,
no need to patch. For better reading and to match
ip_vs_lblcr_check_expire() it can be converted to:
if (time_before(now, en->lastuse+sysctl_ip_vs_lblcr_expiration))
continue;
> if (time_after(en->lastuse+sysctl_ip_vs_lblcr_expiration,
> now))
> continue;
>
> ip_vs_lblcr_free(en);
> atomic_dec(&tbl->entries);
> }
> write_unlock(&svc->sched_lock);
> }
>
> Shouldn't this be "time_before"? It seems that it currently nukes all
> recently-used entries every time this function is called, which seems to
> be every 30 minutes, rather than removing the not-recently-used ones.
>
> If my reading is correct, this patch should fix it. Am I missing
> something?
include/linux/jiffies.h:
time_after(a,b) returns true if the time a is after time b.
#define time_before(a,b) time_after(b,a)
Regards
--
Julian Anastasov <ja@ssi.bg>
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: test
2009-11-05 9:26 ` test Julian Anastasov
@ 2009-11-05 10:11 ` Simon Kirby
0 siblings, 0 replies; 10+ messages in thread
From: Simon Kirby @ 2009-11-05 10:11 UTC (permalink / raw)
To: Julian Anastasov; +Cc: netdev, lvs-devel
On Thu, Nov 05, 2009 at 11:26:27AM +0200, Julian Anastasov wrote:
> If 'time to expire' is after current time then continue,
> i.e. current time didn't reached the limit, seems correct,
> no need to patch. For better reading and to match
> ip_vs_lblcr_check_expire() it can be converted to:
>
> if (time_before(now, en->lastuse+sysctl_ip_vs_lblcr_expiration))
> continue;
D'oh. I noticed the use of time_before() further down in
ip_vs_lblcr_check_expire(), but not the reversed arguments, hence my
confusion.
I still suspect there may be something not quite right, or which could
perhaps do with some tuning. It's difficult to see exactly how it's
working internally, since there's currently nothing to get a summary of
the dest_sets to userspace. I'll follow up if I find anything.
Simon-
^ permalink raw reply [flat|nested] 10+ messages in thread
* test
@ 2010-11-27 3:01 lkernmnet
0 siblings, 0 replies; 10+ messages in thread
From: lkernmnet @ 2010-11-27 3:01 UTC (permalink / raw)
To: netdev
tttttttttttttttttt
^ permalink raw reply [flat|nested] 10+ messages in thread
* test
@ 2013-06-04 6:04 Ding Tianhong
0 siblings, 0 replies; 10+ messages in thread
From: Ding Tianhong @ 2013-06-04 6:04 UTC (permalink / raw)
To: Netdev
test
^ permalink raw reply [flat|nested] 10+ messages in thread
* test
@ 2019-09-07 5:01 Rain River
0 siblings, 0 replies; 10+ messages in thread
From: Rain River @ 2019-09-07 5:01 UTC (permalink / raw)
To: netdev
Please ignore it.
^ permalink raw reply [flat|nested] 10+ messages in thread
* test
2022-09-30 2:18 ` Jakub Kicinski
@ 2022-09-30 13:58 ` jianghaoran
0 siblings, 0 replies; 10+ messages in thread
From: jianghaoran @ 2022-09-30 13:58 UTC (permalink / raw)
To: netdev; +Cc: linux-kernel
^ permalink raw reply [flat|nested] 10+ messages in thread
* test
2025-07-28 23:37 [syzbot] [bpf?] KASAN: slab-out-of-bounds Write in __bpf_get_stackid syzbot
@ 2025-10-12 13:56 ` Arnaud lecomte
0 siblings, 0 replies; 10+ messages in thread
From: Arnaud lecomte @ 2025-10-12 13:56 UTC (permalink / raw)
To: syzbot+c9b724fbb41cf2538b7b
Cc: bpf, linux-kernel, netdev, syzkaller-bugs, contact
#syz test
diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
index 3615c06b7dfa..c0ee51db8eed 100644
--- a/kernel/bpf/stackmap.c
BPF_CALL_3(bpf_get_stackid, struct pt_regs *, regs, struct bpf_map *, map,
u64, flags)
{
- u32 max_depth = map->value_size / stack_map_data_size(map);
- u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
+ u32 elem_size = stack_map_data_size(map);
bool user = flags & BPF_F_USER_STACK;
struct perf_callchain_entry *trace;
bool kernel = !user;
+ u32 max_depth;
if (unlikely(flags & ~(BPF_F_SKIP_FIELD_MASK | BPF_F_USER_STACK |
BPF_F_FAST_STACK_CMP | BPF_F_REUSE_STACKID)))
return -EINVAL;
- max_depth += skip;
- if (max_depth > sysctl_perf_event_max_stack)
- max_depth = sysctl_perf_event_max_stack;
-
+ max_depth = stack_map_calculate_max_depth(map->value_size, elem_size, flags);
trace = get_perf_callchain(regs, 0, kernel, user, max_depth,
false, false);
@@ -371,15 +391,11 @@ BPF_CALL_3(bpf_get_stackid_pe, struct bpf_perf_event_data_kern *, ctx,
return -EFAULT;
nr_kernel = count_kernel_ip(trace);
+ __u64 nr = trace->nr; /* save original */
if (kernel) {
- __u64 nr = trace->nr;
-
trace->nr = nr_kernel;
ret = __bpf_get_stackid(map, trace, flags);
-
- /* restore nr */
- trace->nr = nr;
} else { /* user */
u64 skip = flags & BPF_F_SKIP_FIELD_MASK;
@@ -390,6 +406,10 @@ BPF_CALL_3(bpf_get_stackid_pe, struct bpf_perf_event_data_kern *, ctx,
flags = (flags & ~BPF_F_SKIP_FIELD_MASK) | skip;
ret = __bpf_get_stackid(map, trace, flags);
}
+
+ /* restore nr */
+ trace->nr = nr;
+
return ret;
}
@@ -406,7 +426,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
struct perf_callchain_entry *trace_in,
void *buf, u32 size, u64 flags, bool may_fault)
{
- u32 trace_nr, copy_len, elem_size, num_elem, max_depth;
+ u32 trace_nr, copy_len, elem_size, max_depth;
bool user_build_id = flags & BPF_F_USER_BUILD_ID;
bool crosstask = task && task != current;
u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
@@ -438,21 +458,20 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
goto clear;
}
- num_elem = size / elem_size;
- max_depth = num_elem + skip;
- if (sysctl_perf_event_max_stack < max_depth)
- max_depth = sysctl_perf_event_max_stack;
+ max_depth = stack_map_calculate_max_depth(size, elem_size, flags);
if (may_fault)
rcu_read_lock(); /* need RCU for perf's callchain below */
- if (trace_in)
+ if (trace_in) {
trace = trace_in;
- else if (kernel && task)
+ trace->nr = min_t(u32, trace->nr, max_depth);
+ } else if (kernel && task) {
trace = get_callchain_entry_for_task(task, max_depth);
- else
+ } else {
trace = get_perf_callchain(regs, 0, kernel, user, max_depth,
crosstask, false);
+ }
if (unlikely(!trace) || trace->nr < skip) {
if (may_fault)
@@ -461,7 +480,6 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
}
trace_nr = trace->nr - skip;
- trace_nr = (trace_nr <= num_elem) ? trace_nr : num_elem;
copy_len = trace_nr * elem_size;
ips = trace->ip + skip;
--
2.47.3
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2025-10-12 13:56 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2005-05-05 18:30 test Vlad Yasevich
-- strict thread matches above, loose matches on Subject: below --
2025-07-28 23:37 [syzbot] [bpf?] KASAN: slab-out-of-bounds Write in __bpf_get_stackid syzbot
2025-10-12 13:56 ` test Arnaud lecomte
2022-09-28 6:58 [PATCH] taprio: Set the value of picos_per_byte before fill sched_entry jianghaoran
2022-09-30 2:18 ` Jakub Kicinski
2022-09-30 13:58 ` test jianghaoran
2019-09-07 5:01 test Rain River
2013-06-04 6:04 test Ding Tianhong
2010-11-27 3:01 test lkernmnet
2009-11-04 20:27 test Simon Kirby
2009-11-05 9:26 ` test Julian Anastasov
2009-11-05 10:11 ` test Simon Kirby
2002-11-07 13:54 test Jacky Hsiao
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).