svn commit: r344980 - head/sys/net

[Gleb Smirnoff]

Author: glebius
Date: Sun Mar 10 17:20:09 2019
New Revision: 344980
URL: https://svnweb.freebsd.org/changeset/base/344980

Log:
  Most Ethernet drivers that potentially can run a pfil(9) hook with
  PFIL_MEMPTR flag are intentionally providing a memory address that
  isn't aligned to pointer alignment. This is done to align an IPv4
  or IPv6 header that is expected to follow Ethernet header.
  
  When we return PFIL_REALLOCED we store a pointer to allocated mbuf
  at this address. With this change the KPI changes to store the pointer
  at aligned address, which usually yields in +2 bytes.
  
  Provide two inlines:
  
  pfil_packet_align() to get aligned pfil_packet_t for a misaligned one
  pfil_mem2mbuf() to read out mbuf pointer from misaligned pfil_packet_t
  
  Provide function pfil_realloc(), not used yet, that would convert a
  memory pfil_packet_t to an mbuf one.
  
  Reported by:	hps
  Reviewed by:	hps, gallatin

Modified:
  head/sys/net/pfil.c
  head/sys/net/pfil.h

Modified: head/sys/net/pfil.c
==============================================================================
--- head/sys/net/pfil.c	Sun Mar 10 17:08:05 2019	(r344979)
+++ head/sys/net/pfil.c	Sun Mar 10 17:20:09 2019	(r344980)
@@ -118,15 +118,31 @@ VNET_DEFINE_STATIC(struct pfilhookhead, pfil_hook_list
 static struct pfil_link *pfil_link_remove(pfil_chain_t *, pfil_hook_t );
 static void pfil_link_free(epoch_context_t);
 
+int
+pfil_realloc(pfil_packet_t *p, int flags, struct ifnet *ifp)
+{
+	struct mbuf *m;
+
+	MPASS(flags & PFIL_MEMPTR);
+
+	if ((m = m_devget(p->mem, PFIL_LENGTH(flags), 0, ifp, NULL)) == NULL)
+		return (ENOMEM);
+	*p = pfil_packet_align(*p);
+	*p->m = m;
+
+	return (0);
+}
+
 static __noinline int
-pfil_fake_mbuf(pfil_func_t func, void *mem, struct ifnet *ifp, int flags,
+pfil_fake_mbuf(pfil_func_t func, pfil_packet_t *p, struct ifnet *ifp, int flags,
     void *ruleset, struct inpcb *inp)
 {
 	struct mbuf m, *mp;
 	pfil_return_t rv;
 
 	(void)m_init(&m, M_NOWAIT, MT_DATA, M_NOFREE | M_PKTHDR);
-	m_extadd(&m, mem, PFIL_LENGTH(flags), NULL, NULL, NULL, 0, EXT_RXRING);
+	m_extadd(&m, p->mem, PFIL_LENGTH(flags), NULL, NULL, NULL, 0,
+	    EXT_RXRING);
 	m.m_len = m.m_pkthdr.len = PFIL_LENGTH(flags);
 	mp = &m;
 	flags &= ~(PFIL_MEMPTR | PFIL_LENMASK);
@@ -135,10 +151,11 @@ pfil_fake_mbuf(pfil_func_t func, void *mem, struct ifn
 	if (rv == PFIL_PASS && mp != &m) {
 		/*
 		 * Firewalls that need pfil_fake_mbuf() most likely don't
-		 * know to return PFIL_REALLOCED.
+		 * know they need return PFIL_REALLOCED.
 		 */
 		rv = PFIL_REALLOCED;
-		*(struct mbuf **)mem = mp;
+		*p = pfil_packet_align(*p);
+		*p->m = mp;
 	}
 
 	return (rv);
@@ -168,8 +185,8 @@ pfil_run_hooks(struct pfil_head *head, pfil_packet_t p
 	PFIL_EPOCH_ENTER(et);
 	CK_STAILQ_FOREACH(link, pch, link_chain) {
 		if ((flags & PFIL_MEMPTR) && !(link->link_flags & PFIL_MEMPTR))
-			rv = pfil_fake_mbuf(link->link_func, p.mem, ifp,
-			    flags, link->link_ruleset, inp);
+			rv = pfil_fake_mbuf(link->link_func, &p, ifp, flags,
+			    link->link_ruleset, inp);
 		else
 			rv = (*link->link_func)(p, ifp, flags,
 			    link->link_ruleset, inp);

Modified: head/sys/net/pfil.h
==============================================================================
--- head/sys/net/pfil.h	Sun Mar 10 17:08:05 2019	(r344979)
+++ head/sys/net/pfil.h	Sun Mar 10 17:20:09 2019	(r344980)
@@ -98,8 +98,25 @@ struct inpcb;
 typedef union {
 	struct mbuf	**m;
 	void		*mem;
+	uintptr_t	__ui;
 } pfil_packet_t __attribute__((__transparent_union__));
 
+static inline pfil_packet_t
+pfil_packet_align(pfil_packet_t p)
+{
+
+	return ((pfil_packet_t ) (((uintptr_t)(p).mem +
+	    (_Alignof(void *) - 1)) & - _Alignof(void *)));
+}
+
+static inline struct mbuf *
+pfil_mem2mbuf(void *v)
+{
+
+	return (*(struct mbuf **) (((uintptr_t)(v) +
+	    (_Alignof(void *) - 1)) & - _Alignof(void *)));
+}
+
 typedef enum {
 	PFIL_PASS = 0,
 	PFIL_DROPPED,
@@ -187,6 +204,11 @@ struct _pfil_head {
 };
 #define	PFIL_HOOKED_IN(p) (((struct _pfil_head *)(p))->head_nhooksin > 0)
 #define	PFIL_HOOKED_OUT(p) (((struct _pfil_head *)(p))->head_nhooksout > 0)
+
+/*
+ * Alloc mbuf to be used instead of memory pointer.
+ */
+int	pfil_realloc(pfil_packet_t *, int, struct ifnet *);
 
 #endif /* _KERNEL */
 #endif /* _NET_PFIL_H_ */