Re: [PATCH] net: Fix security_socket_sendmsg() bypass problem.
From: Casey Schaufler <casey@schaufler-ca.com>
Date: 2011-07-25 17:00:29
On 7/25/2011 9:43 AM, Tetsuo Handa wrote:
Casey Schaufler wrote:quoted
quoted
OK. Then, the question is how to reduce performance loss by redundant security_socket_sendmsg() calls.Not to be splitting hairs, but if the packets are headed to different destinations the calls to security_socket_sendmsg() are not redundant, they are necessary and appropriate. What you have with sendmmsg() is an optimization that sacrifices correctness for performance.Excuse me, but this thread is not trying to remove necessary and appropriate security_socket_sendmsg() calls. Linux 3.0 was released without necessary and appropriate security_socket_sendmsg() calls, and I'm trying to correct it (via msg11504.html or msg11510.html) for Linux 3.0.x stable release.
I understand. Sorry if I did a poor job of jumping into the thread.
quoted
I fear that you are going to find that the work you have to do to reduce the number of calls is going to outweigh the benefits of your optimization, as has been pointed out earlier.I fear it too. Unless many dozens (maybe some hundreds) of packets are sent by sendmmsg(), msg11504.html might show better performance than msg11510.html . But I don't have a machine to benchmark.
Is there some chance that the original authors could step up to help with the benchmarking effort on this repair? Having been on the end where I introduced problems more than once, I have a good understanding of the principle "you broke it, you bought it".