A received sk buffer may contain dozens of smaller 'bundled' messages
which after extraction go each in their own direction.
Unfortunately, when we extract those messages using skb_clone() each
of the extracted buffers inherit the truesize value of the original
buffer. Apart from causing massive overaccounting of the base buffer's
memory, this often causes tipc_msg_validate() to come to the false
conclusion that the ratio truesize/datasize > 4, and perform an
unnecessary copying of the extracted buffer.
We now fix this problem by explicitly correcting the truesize value of
the buffer clones to be the truesize of the clone itself plus a
calculated fraction of the base buffer's overhead. This change
eliminates the overaccounting and at least mitigates the occurrence
of unnecessary buffer copying.
Reported-by: Hoang Le <hoang.h...@dektek.com.au>
Acked-by: Ying Xue <ying....@windriver.com>
Signed-off-by: Jon Maloy <jon.ma...@ericsson.com>
---
net/tipc/msg.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 4e1c6f6..ce0bfc4 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -416,8 +416,8 @@ bool tipc_msg_bundle(struct sk_buff *skb, struct tipc_msg
*msg, u32 mtu)
*/
bool tipc_msg_extract(struct sk_buff *skb, struct sk_buff **iskb, int *pos)
{
+ int imsz, offset, clone_cnt, skb_overhead;
struct tipc_msg *msg;
- int imsz, offset;
*iskb = NULL;
if (unlikely(skb_linearize(skb)))
@@ -434,6 +434,11 @@ bool tipc_msg_extract(struct sk_buff *skb, struct sk_buff
**iskb, int *pos)
skb_pull(*iskb, offset);
imsz = msg_size(buf_msg(*iskb));
skb_trim(*iskb, imsz);
+
+ /* Scale extracted buffer's truesize to avoid double accounting */
+ clone_cnt = max_t(u32, 1, msg_msgcnt(msg));
+ skb_overhead = skb->truesize - skb->len;
+ (*iskb)->truesize = SKB_TRUESIZE(imsz) + skb_overhead / clone_cnt;
if (unlikely(!tipc_msg_validate(iskb)))
goto none;
*pos += align(imsz);
--
2.1.4
