62 lines
2.6 KiB
Markdown
62 lines
2.6 KiB
Markdown
# UNDF: UNDF-2026-000000150
|
||
# linux-0007 — `pktgen`: O(T×D) nested list scan in `__pktgen_NN_threads` and `pktgen_change_name`
|
||
|
||
## Status
|
||
PATCHED
|
||
|
||
## Severity
|
||
MEDIUM (>20× speedup at T=10, D=100)
|
||
|
||
## Location
|
||
`net/core/pktgen.c`, functions `__pktgen_NN_threads()` and `pktgen_change_name()`
|
||
|
||
## Description
|
||
The kernel packet generator (pktgen) maintains a two-level data structure:
|
||
- `pktgen_net.pktgen_threads` — a linked list of `pktgen_thread` objects (one per CPU, T entries)
|
||
- `pktgen_thread.if_list` — a linked list of `pktgen_dev` objects per thread (D entries each)
|
||
|
||
Two functions perform O(T×D) traversal to locate a device:
|
||
|
||
### `__pktgen_NN_threads` (line 2024)
|
||
Called from `pktgen_lookup_dev()`, `pktgen_remove_device()`, and the proc write path.
|
||
```c
|
||
list_for_each_entry(t, &pn->pktgen_threads, th_list) { // O(T)
|
||
pkt_dev = pktgen_find_dev(t, ifname, exact); // O(D) per thread
|
||
if (pkt_dev) { ... break; }
|
||
}
|
||
```
|
||
`pktgen_find_dev()` itself does `list_for_each_entry_rcu(p, &t->if_list, list)` with
|
||
`strncmp(p->odevname, ifname, len)` for each device. Total: **O(T×D) per device lookup**.
|
||
|
||
### `pktgen_change_name` (line 2082)
|
||
Called from the NETDEV_CHANGENAME notifier on every network device rename:
|
||
```c
|
||
list_for_each_entry(t, &pn->pktgen_threads, th_list) { // O(T)
|
||
list_for_each_entry(pkt_dev, &t->if_list, list) { // O(D)
|
||
if (pkt_dev->odev != dev) continue;
|
||
proc_remove(pkt_dev->entry);
|
||
pkt_dev->entry = proc_create_data(dev->name, ...);
|
||
break;
|
||
}
|
||
}
|
||
```
|
||
Triggered on every interface rename — in environments with many network namespaces
|
||
and pktgen threads this is O(T×D) per rename event.
|
||
|
||
## Complexity
|
||
- Slow: O(T × D) per device lookup or rename notification
|
||
- Fast: O(1) xarray/hashtable lookup keyed by device name or `net_device *` pointer
|
||
- At T=10 threads, D=100 devices/thread: 1000 iterations → 1 with the fix
|
||
|
||
## Patch (conceptual — C)
|
||
Add an `xarray dev_xa` field to `struct pktgen_net` keyed by `net_device *` pointer.
|
||
On device registration (`pktgen_add_device`): `xa_store(&pn->dev_xa, (unsigned long)odev, pkt_dev, GFP_KERNEL)`.
|
||
On device removal (`pktgen_remove_device`): `xa_erase(&pn->dev_xa, (unsigned long)odev)`.
|
||
`__pktgen_NN_threads` for exact match: `xa_load(&pn->dev_xa, (unsigned long)dev)` — O(1).
|
||
`pktgen_change_name`: `xa_load(&pn->dev_xa, (unsigned long)dev)` — O(1).
|
||
|
||
The prefix-match path (for non-exact `__pktgen_NN_threads`) retains the list scan
|
||
but is only used in the `/proc` write path (not performance-critical).
|
||
|
||
## Patch file
|
||
See `linux-0007-pktgen-thread-dev-xarray.patch`
|