vxlan_vnifilter_dump_dev() coalesces a contiguous run of VNIs sharing a
remote into one VXLAN_VNIFILTER_ENTRY, and packs as many entries into a
netlink message as the skb holds, with no bound on either. A later patch
bounds a single request to VXLAN_VNI_FILTER_MSG_MAX VNIs summed over its
entries; without a matching bound on the dump, a device holding more than
that -- populated by several requests -- would dump a run, or a message,
that the input path then refuses on replay.
Introduce VXLAN_VNI_FILTER_MSG_MAX here and clamp the dump to it first, so
the series never passes through a commit where the kernel reports a range
its own input path rejects. Bound the two ways the dump can exceed the
limit:
- end a coalesced run once it reaches the limit, in the merge condition,
even when the next VNI is contiguous and shares the remote; and
- carry a per-message VNI budget, ending the message once its entries
would sum past the limit, the same way the loop already ends it when
the skb is full.
cb->args[1] continues to count the VNI nodes already dumped and is advanced
only when a completed entry is written, so the budget break and the
skb-full break share one resume path; a run stays a gapless block, so the
dump never drops a VNI and never emits one twice.
Assisted-by: LLM
Signed-off-by: Ali Firas <[email protected]>
---
v4: moved before the input cap; now introduces
VXLAN_VNI_FILTER_MSG_MAX and adds a per-message VNI budget (v3 clamped
per entry only), so the dump never emits a message the input path
rejects.
drivers/net/vxlan/vxlan_vnifilter.c | 29 +++++++++++++++++++++++++++--
1 file changed, 27 insertions(+), 2 deletions(-)
diff --git a/drivers/net/vxlan/vxlan_vnifilter.c
b/drivers/net/vxlan/vxlan_vnifilter.c
index 9e15f4de75c9..5beec29eb84a 100644
--- a/drivers/net/vxlan/vxlan_vnifilter.c
+++ b/drivers/net/vxlan/vxlan_vnifilter.c
@@ -17,6 +17,13 @@
#include "vxlan_private.h"
+/* The dump coalesces a contiguous run of VNIs into entries, and packs entries
+ * into netlink messages, of at most this many VNIs each, so every message the
+ * dump emits stays within what the input path will accept on replay. A later
+ * patch bounds a single RTM_NEWTUNNEL/RTM_DELTUNNEL request to the same
number.
+ */
+#define VXLAN_VNI_FILTER_MSG_MAX 4096
+
static inline int vxlan_vni_cmp(struct rhashtable_compare_arg *arg,
const void *ptr)
{
@@ -342,6 +349,7 @@ static int vxlan_vnifilter_dump_dev(const struct net_device
*dev,
struct nlmsghdr *nlh;
int idx = 0, s_idx;
bool dump_stats;
+ u32 vnis = 0;
int err = 0;
if (cb->args[2] != dev->ifindex) {
@@ -388,15 +396,29 @@ static int vxlan_vnifilter_dump_dev(const struct
net_device *dev,
continue;
}
if (!dump_stats && vnirange(vend, v) == 1 &&
+ vnirange(vbegin, v) < VXLAN_VNI_FILTER_MSG_MAX &&
vxlan_addr_equal(&v->remote_ip, &vend->remote_ip)) {
goto update_end;
} else {
+ u32 sz = vnirange(vbegin, vend) + 1;
+
+ /* End this message on its VNI budget the same way we
+ * end it when the skb is full, so a dumped message
+ * never sums to more VNIs than the input path accepts
+ * in one request. Resume re-emits this run as the
+ * first entry of the next message.
+ */
+ if (vnis + sz > VXLAN_VNI_FILTER_MSG_MAX) {
+ err = -EMSGSIZE;
+ break;
+ }
if (!vxlan_fill_vni_filter_entry(skb, vbegin, vend,
dump_stats)) {
err = -EMSGSIZE;
break;
}
- idx += vnirange(vbegin, vend) + 1;
+ vnis += sz;
+ idx += sz;
vbegin = v;
}
update_end:
@@ -404,7 +426,10 @@ static int vxlan_vnifilter_dump_dev(const struct
net_device *dev,
}
if (!err && vbegin) {
- if (!vxlan_fill_vni_filter_entry(skb, vbegin, vend, dump_stats))
+ if (vnis + vnirange(vbegin, vend) + 1 >
VXLAN_VNI_FILTER_MSG_MAX)
+ err = -EMSGSIZE;
+ else if (!vxlan_fill_vni_filter_entry(skb, vbegin, vend,
+ dump_stats))
err = -EMSGSIZE;
}
--
2.53.0
