On 2018/8/9 20:52, David Woodhouse wrote:
> On Thu, 2018-08-09 at 14:47 +0200, Greg KH wrote:
>> On Thu, Aug 09, 2018 at 08:37:13PM +0800, maowenan wrote:
>>> There are two patches in stable branch linux-4.4, but I have tested with
>>> below patches, and found that the cpu usage was very high.
>>> dc6ae4d tcp: detect malicious patterns in tcp_collapse_ofo_queue()
>>> 5fbec48 tcp: avoid collapses in tcp_prune_queue() if possible
>>>
>>> test results:
>>> with fix patch： 78.2% ksoftirqd
>>> no fix patch： 90% ksoftirqd
>>>
>>> there is %0 when no attack packets.
>>>
>>> so please help verify that fixed patches are enough in linux-stable 4.4.
>>>
>>
>> I do not know, I am not a network developer. Please try to reproduce
>> the same thing on a newer kernel release and see if the result is the
>> same or not. If you can find a change that I missed, please let me know
>> and I will be glad to apply it.
>
> maowenan, there were five patches in the original upstream set to
> address SegmentSmack:
>
> tcp: free batches of packets in tcp_prune_ofo_queue()
> tcp: avoid collapses in tcp_prune_queue() if possible
> tcp: detect malicious patterns in tcp_collapse_ofo_queue()
> t
> cp: call tcp_drop() from tcp_data_queue_ofo()
> tcp: add
> tcp_ooo_try_coalesce() helper
>
> I believe that the first one, "free batches of packets..." is not
> needed in 4.4 because we only have a simple queue of packets there
> anyway, so we're dropping everything each time and don't need the
> heuristics for how many to drop.
>
> That leaves two more which have so far not been backported to 4.4; can
> you try applying them and see if it resolves the problem for you?
I have tried to add below two patches in 4.4 stable, since I can't apply
tcp: add tcp_ooo_try_coalesce() helper because conflicts, it has the same result
after testing, and the cpu usage has not obviously been improved.
tcp: call tcp_drop() from tcp_data_queue_ofo()
tcp: increment sk_drops for dropped rx packets
@Eric Dumazet, do you have any comments about this, and shall we apply which
patches
to fix in stable branch?
>
> Thanks.
>
