Code Monkey home page Code Monkey logo

fastos / fastsocket Goto Github PK

View Code? Open in Web Editor NEW
3.8K 421.0 729.0 120.99 MB

Fastsocket is a highly scalable socket and its underlying networking implementation of Linux kernel. With the straight linear scalability, Fastsocket can provide extremely good performance in multicore machines. In addition, it is very easy to use and maintain. As a result, it has been deployed in the production environment of SINA.

License: GNU General Public License v2.0

Makefile 0.29% C 94.89% Shell 0.03% Perl 0.08% Assembly 2.22% C++ 2.14% Objective-C 0.24% Awk 0.01% Python 0.03% UnrealScript 0.01% Scilab 0.01% ASP 0.01% Perl 6 0.01% CMake 0.01% XS 0.01% Yacc 0.03% Lex 0.02% GDB 0.01%

fastsocket's Introduction

README for FASTSOCKET

TABLE OF CONTENT

PAPER

ASPLOS 2016

http://dl.acm.org/citation.cfm?id=2872391

INTRODUCTION

With a rapid growth of NIC bandwidth and CPU cores on one single machine, a scalable TCP network stack is performance-critical. However, stock Linux kernel does not scale well when CPU core number is above 4. It is even worse that the throughput could collapse when there are more than 12 CPU cores.

Fastsocket is a scalable kernel TCP socket implementation and achieves a straight linear performance growth when scaling up to 24 CPU cores. Meanwhile, The underlying kernel optimization of Fastsocket is transparent for socket applications, which means existing applications can take advantage of Fastsocket without changing their codes.

Currently Fastsocket is implemented in the Linux kernel(kernel-2.6.32-431.29.2.el6.x86_64) of CentOS-6.5 which is the latest version of redhat EL6, since CentOS-6.5 is our major production environment system. According to our evaluations, Fastsocket increases throughput of Nginx and HAProxy(measured by connections per second) by 290% and 620% on a 24-core machine, compared to the base CentOS-6.5 kernel.

Moreover, Fastsocket can further exploit more from the hardware:

  • With Fastsocket, Hyper-Threading can make an extra 20% performance increase.
  • With Fastsocket, NIC that support Flow-Director(like Intel 82599) can increase the throughput by 15% if the server works as a proxy(like HAProxy).

Fastsocket (V1.0) has already been deployed in the SINA production environment. Fastsocket is used with HAProxy to provide HTTP load balance service and has been running stably since March 2014 More details are in the Evaluation.

Fastsocket is released under GPLv2 and we promise that we would never ask for any payment to use our codes.

PARTICIPANTS

  • Fastsocket is started and mainly developed by Xiaofeng Lin from the OS team of SINA.COM.
  • OS center of Tsinghua is cooperating closely with SINA.COM to further enhance Fastsocket.
  • Fastsocket is also supported by Intel with extensive assistance.
  • Zeuux Community is providing open source consulting for Fastsocket.

INSTALLATION

INSTALL FROM SOURCE

The source code is available at https://github.com/fastos/fastsocket.git. Clone the repository by:

[root@localhost ~]# git clone https://github.com/fastos/fastsocket.git

Here is a brief introduction to the directories in the repository.

  • kernel - source code of the Fastsocket customized kernel
  • module - source code of the Fastsocket kernel module
  • library - source code of user-level library to support Fastsocket
  • scripts - scripts to set NIC and system environment(NOT compulsory for Fastsocket)
  • demo - source code of a demo server to demonstrate performance of Fastsocket

The following commands will build and install the kernel after Fastsocket repository is downloaded from git. You can customize the config file if you are sure you will not miss some important component. Fastsocket can be built smoothly on 64-bit CentOS-6.X systems. Problems may arise on 32-bit systems and CentOS-7 systems.

[root@localhost ~]# cd fastsocket/kernel
[root@localhost kernel]# make defconfig
[root@localhost kernel]# make
[root@localhost kernel]# make modules_install
[root@localhost kernel]# make install

Enter the library directory and make the library:

[root@localhost fastsocket]# cd library
[root@localhost library]# make

After that, libfsocket.so is created in the same directory.

SWITCH KERNEL

When the installation is done, remember to modify grub file to switch to the Fastsocket kernel and reboot the system.

SYSTEM CONFIGURATION

After booting into the kernel with Fastsocket, load the Fastsocket module with default parameters:

[root@localhost ~]# modprobe fastsocket

For more detailed information of modules parameters, please refer to Module.

Two ways to check if the module is loaded successfully.

  • Check lsmod:

      [root@localhost ~]# lsmod | grep fastsocket
      fastsocket             23145  0
    
  • Check dmesg:

      [root@localhost ~]# dmesg | tail
      Fastsocket: Load Module
      Fastsocket: Enable Listen Spawn[Mode-2]
      Fastsocket: Enable Recieve Flow Deliver
      Fastsocket: Enable Fast Epoll
    

Run nic.sh provided in the scripts directory of the repository to take care of remaining configuration.

[root@localhost ~]# cd fastsocket
[root@localhost fastsocket]# scripts/nic.sh -i eth0

eth0 is the interface to be used and should be changed according to your system configuration. The script will automatically check system and NIC parameters, then configures various features.

If you are interested in how nic.sh works, please refer to Scripts.

USAGE

SUITABLE SCENARIOS###

Generally, scenarios meeting the following conditions will benefit the most from Fastsocket (V1.0):

  • The machine has no less than 8 CPU cores.
  • Large portion of the CPU cycles is spent in network softirq and socket related system calls.
  • Short TCP connections are heavily used.
  • Application uses non-blocking IO over epoll as the IO framework.
  • Application uses multiple processes to accept connections individually.

Meanwhile, we are developing Fastsocket to improve the network stack performance in more general scenarios. You can refer to New Features.

HOW TO USE

Fastsocket is enabled by preloading a shared library named libfsocket.so when launching an application. For example, ngnix can be started with Fastsocket by:

[root@localhost fastsocket]# cd library
[root@localhost library]# LD_PRELOAD=./libfsocket.so nginx

Without the preloaded library, applications can run as if they are on the original kernel, which provides a super quick rollback in case there is a need.

[root@localhost ~]# nginx

For more information about the library, please refer to Library.

Here we list a few applications that are working fine with Fastsocket:

  • haproxy
  • nginx (Do disable accept mutex)
  • lighttpd

We are also using Fastsocket on the load generators in our benchmark tests. This is very helpful since Fastsocket greatly increases the maximum work load that could be generated from a single machine, which saves machines and operations. These load generators are:

  • ab
  • http_load

DEMO SERVER

We provide a demo server in the demo directory of the repository. The demo server does nothing but read/write messages from/to network sockets and is purely used to study and benchmark the performance of network stack of Linux kernel. When the demo server is running, it has little user CPU consumption, which makes it a perfect network application to observe the network stack performance.

Moreover, it is also used to demonstrate the scalability and performance improvement of Fastsocket over the base Linux kernel.

For more information about the demo server, please refer to Demo.

EVALUATION

Nginx

Some important configurations:

  • Worker number is set to the number of CPU cores.
  • HTTP Keep-alive is disabled on Nginx for a short connection test.
  • Http_load fetches a 64 bytes static file from Nginx with a concurrency of 500 multiplied by the number of cores.
  • We enable memory cache for that static file in order to rule out any disk affection.
  • accept mutex is disabled. The default value of nginx is on.

Note: YOU'D BETTER DO DISABLE accept_mutex! With default Fastsocket module parameters, Fastsocket has partioned listen socket, therefore, there is no need to force user to accept connections one by one. If some cpu had no chance to receive packet especially the tcp syn packet by RPS or others, the nginx would fail to accept the new conn forever with accept_mutex enabled. So you should make sure the new request could be passed to every CPU, if you want load blance the accept with accept mutex of nginx.

From the figure below, Fastsocket on 24 CPU cores achieves 475K connection per second (cps), with a speed up of 21X. The throughput of base CentOS-6.5 kernel increases non-linearly up to 12 CPU cores and drops dramatically to 159K cps with 24 CPU cores. The latest 3.13 kernel doubles the throughput to 283K cps when using 24 CPU cores compared with the base CentOS-6.5 kernel. However, it has not completely solved the scalability bottlenecks, preventing it from scaling beyond 12 CPU cores.

HAProxy

Some important configurations:

  • Worker number is set to the number of CPU cores.
  • RFD(Receive Flow Deliver) in Fastsocket is enabled.
  • HTTP Keep-alive is disabled on HAProxy for a short connection test.
  • A client runs http_load with a concurrency of 500 multiplied by number of cores.
  • A backend server responds each incoming HTTP request with a 64 bytes message.

As shown in the same figure, Fastsocket presents an excellent scalability performance, which is very similar to the previous Nginx case. Fastsocket outperforms Linux 3.13 by 139K cps and base CentOS-6.5 kernel by 370K cps when using 24 CPU cores, though the one core throughputs are very close among all the three kernels.

Throughput

ONLINE EVALUATION

As mentioned before, Fastsocket has already been deployed in the SINA production environment. One typical scenario is using Fastsocket with HAProxy to provide HTTP load balance service to WEIBO and other SINA productions.

In the figure below, it is the CPU utilization of an 8-core servers within 24 hours. Figure (a) shows the CPU utilization before deploying Fastsocket and figure (b) shows the CPU utilization after deploying Fastsocket.

Online

We can see from the figure, what happened after Fastsocket is used:

  • The load of each CPU core is perfect balanced.
  • The average CPU utilization of all CPU cores is reduced by 10%.
  • As a result, the effective capacity of the HAProxy server is increased by 85%.

Moreover, since the server is an old 8-core machine, we expect Fastsocket would make more performance improvement when Fastsocket is deployed on a machine with more CPU cores (It is already observed on a 12-core machine after updating Fastsocket).

NEW FEATURES

We are now improving network stack efficiency in the case of long TCP connection. Four more features are introduced:

  • Direct-TCP: Skip the route process when receiving packets if these packets belong to upper TCP sockets.
  • Skb-Pool: Get skb from per-core pre-allocated skb pool instead of kernel slab.
  • Receive-CPU-Select: Steer a packet to a CPU core where application is waiting for it. The idea is similar with RFS from Google, however, it is lighter and more accurate.
  • RPS-Framework: We extend the idea of RPS that is to redispatch the receiving packets before they entering the network stack. We build a framework where developers can implement their own packets-redispatching rules in out-of-tree module and hook into the RPS framework.

We evaluated our new work on redis which is a typical and popular key-value cache application.

Some important configurations:

  • Redis works in persistent TCP connection mode.
  • Multiple Redis instances are set up.
  • Each Redis instance listens on a different port and binds to a different CPU core.

The 8-redis-instance test shows:

  • With commodity NIC supporting RSS, Fastsocket improves the throughput by more than 20%.
  • WIth advanced NIC supporting Flow-Director(Intel 82599), a 45% improvement can be reached.

Notes:

  • These new features are in the experimental stage, neither well tuned for performance, nor proved stable by long-time production environment running.
  • There new features are complementary to the features in V1.0, therefore, Nginx and HAProxy performance can be further increased by Fastsocket with these new features.

CONTACTS

Mailing-list: [email protected]
Google Group: fastsocket-dev (https://groups.google.com/forum/#!forum/fastsocket-dev)

Sending a mail to the address above will subcribe to the mailing list. The subject and message do not matter.

fastsocket's People

Contributors

0x333333 avatar breezewoods avatar bszcz avatar eiriksm avatar foobar avatar gfreewind avatar igroykt avatar moreandres avatar objectkuan avatar yifei429 avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

fastsocket's Issues

ERROR: modinfo:

我的操作系统环境是64位Centos6.5,在执行make install过程中出现以下错误:
ERROR: modinfo: could not find module vmhgfs
ERROR: modinfo: could not find module vsock
ERROR: modinfo: could not find module vmci
想问一下是什么原因?

将FastSocket迁移到PowerLinux平台的一些问题。

Hi there

我尝试将FastSocket内核和模块都迁移到了PLinux(Linux On Power)平台,几乎未碰到错误(除了一个亲和性绑定sched_setaffinity 返回值EINVAL)。

在测试过程中,我发现如果不启用fastsocket加速,demo 程序 Server能做到4个(我只启动了4个worker)并行处理;但启用fastsocket以后,从运行观察中只看到一个server在处理,其他都是空闲状态。

因为这样的现象,所以启用Fastsocket以后,反而性能不如未启用前。请指教大致的原因何在?与CPU亲和那个函数是否有关?

fastsocket的spec文件

你好,请问可以提供下fastsocket的spec文件吗?我用centos src的spec不能正常进行编译 :-)

安装报错, 重启失败

你好, 我的 centos 6.5 在 编译安装内核的时候报错
sh /usr/local/src/fastsocket/kernel/arch/x86/boot/install.sh 2.6.32-431.29.2.el6.FASTSOCKET arch/x86/boot/bzImage
System.map "/boot"
Invalid output format udev. Choose from value,
device, list, or full
Invalid output format udev. Choose from value,
device, list, or full
Invalid output format udev. Choose from value,
device, list, or full
Invalid output format udev. Choose from value,
device, list, or full
Invalid output format udev. Choose from value,
device, list, or full
重启之后
image

fastsocket/tengine web服务器内存泄露

1、环境说明:
服务器配置:
CPU:16核Intel(R) Xeon(R) CPU E5620@ 2.40GHz
内存:20G
硬盘:900G
网卡:(eth5)Intel Corporation I350 Gigabit Network Connection (rev 01)
8队列千兆(队列绑定到后8个CPU核)
系统:CentOS release 6.4 (Final)
内核版本:
image
有执行nic.sh脚本
tengine版本:
image
2、测试前,加载fastsocket.ko(默认参数),使用libfsocket.so启动tengine
image
image
3、Client用wrk
image
4、测试完成后,内存情况
image
几分钟后,内存情况
image
又几分钟后,内存情况
image
同样,用fastos, 不加载fastsocket.ko,不使用libfsocket.so启动tengine,则不存在泄漏。
用fastsocket,tengine作proxy不存在泄漏。

不知是否遇到此问题,还是我本人的测试有问题,求指导。

Upstream

It would be amazing to see this in the mainline kernel.
What is the status of this?

Centos Install fastsocket Error

我在centos 6.5 x_86下面编译安装fastsocket时报了一下错误 请问是什么问题??
[root@bogon kernel]# make defconfig
HOSTCC scripts/basic/fixdep
HOSTCC scripts/basic/docproc
HOSTCC scripts/basic/hash
HOSTCC scripts/kconfig/conf.o
HOSTCC scripts/kconfig/kxgettext.o
HOSTCC scripts/kconfig/zconf.tab.o
HOSTLD scripts/kconfig/conf
*** Default configuration is based on 'i386_defconfig'

configuration written to .config

[root@bogon kernel]# make
scripts/kconfig/conf -s arch/x86/Kconfig
CHK include/linux/version.h
CHK include/linux/utsrelease.h
SYMLINK include/asm -> include/asm-x86
CC kernel/bounds.s
GEN include/linux/bounds.h
CC arch/x86/kernel/asm-offsets.s
GEN include/asm/asm-offsets.h
CALL scripts/checksyscalls.sh
CC scripts/mod/empty.o
HOSTCC scripts/mod/mk_elfconfig
MKELF scripts/mod/elfconfig.h
HOSTCC scripts/mod/file2alias.o
scripts/mod/file2alias.c:797: 警告:‘do_x86cpu_entry’定义后未使用
HOSTCC scripts/mod/modpost.o
HOSTCC scripts/mod/sumversion.o
HOSTLD scripts/mod/modpost
HOSTCC scripts/mod/mod-extract
HOSTCC scripts/selinux/genheaders/genheaders
HOSTCC scripts/selinux/mdp/mdp
HOSTCC scripts/kallsyms
HOSTCC scripts/pnmtologo
HOSTCC scripts/conmakehash
CC init/main.o
CHK include/linux/compile.h
UPD include/linux/compile.h
CC init/version.o
CC init/do_mounts.o
CC init/do_mounts_rd.o
cc1: warnings being treated as errors
In file included from include/linux/kmemtrace.h:12,
from include/linux/slub_def.h:13,
from include/linux/slab.h:162,
from include/linux/percpu.h:5,
from include/linux/percpu_counter.h:13,
from include/linux/fs.h:433,
from init/do_mounts_rd.c:3:
include/trace/events/kmem.h:528: 错误:‘struct address_space’在形参表内部声明
include/trace/events/kmem.h:528: 错误:它的作用域仅限于此定义或声明,这可能并不是您想要的
include/trace/events/kmem.h:528: 错误:‘struct address_space’在形参表内部声明
include/trace/events/kmem.h:528: 错误:‘struct address_space’在形参表内部声明
make[1]: *** [init/do_mounts_rd.o] 错误 1
make: *** [init] 错误 2
[root@bogon kernel]# uname -a
Linux bogon 2.6.32-504.1.3.el6.i686 #1 SMP Tue Nov 11 16:30:09 UTC 2014 i686 i686 i386 GNU/Linux

Security Vulnerability - Action Required: some unpatched vulnerabilities are detected in your repo

Hi,
our team have developed a recurring vulnerability detection tool. This tool mainly uses static analysis methods, and it has a high detection accuracy in our dataset. We have also received positive feedback from other projects before.
we have scanned your fastsocket and found some vulnerabilities, which were confirmed and fixed by linux do not get patched in this repo. Here are some details as follows:

  1. inet_create and inet6_create functions from kernel/net/ipv4/af_inet.c and kernel/net/ipv6/af_inet6.c respectively, which shares the similarity with CVE-2015-8543 and the patch is torvalds/linux@79462ad
  2. pipe_iov_copy_from_user and pipe_iov_copy_to_user functions from kernel/fs/pipe.c , which shares the similarity with CVE-2015-1805 and the patch is torvalds/linux@637b58c
  3. __mptctl_ioctl, mptctl_do_reset, mptctl_fw_download, mptctl_getiocinfo, mptctl_gettargetinfo, mptctl_readtest, mptctl_eventquery, mptctl_eventenable, mptctl_eventreport, mptctl_replace_fw, mptctl_mpt_command, mptctl_hp_hostinfo, mptctl_hp_targetinfo, compat_mptfwxfer_ioctl and compat_mpt_command functions from kernel/drivers/message/fusion/mptctl.c, which shares the similarity with CVE-2020-12652 and the patch is torvalds/linux@28d76df
  4. sunkbd_interrupt function from kernel/net/ipv4/af_inet.c and kernel/drivers/input/keyboard/sunkbd.c, which shares the similarity with CVE-2020-25669 and the patch is torvalds/linux@77e70d3
  5. vgacon_scroll function from kernel/drivers/video/console/vgacon.c, which shares the similarity with CVE-2020-28097 and the patch is torvalds/linux@973c096
  6. notify_change function from kernel/fs/attr.c, which shares the similarity with CVE-2015-1350 and the patch is torvalds/linux@030b533
  7. enable_nmi_window from kernel/arch/x86/kvm/svm.c, which shares the similarity with CVE-2015-8104 and the patch is torvalds/linux@cbdb967
  8. isdn_ppp_ioctl, slhc_init, and sl_alloc_bufs functions from kernel/drivers/isdn/i4l/isdn_ppp.c, kernel/drivers/net/slhc.c and kernel/drivers/net/slip.c respectively, which shares the similarity with CVE-2015-7799 and the patch is torvalds/linux@4ab42d7
  9. ext4_ext_split from kernel/fs/ext4/extents.c, which shares the similarity with CVE-2019-11833 and the patch is torvalds/linux@592acbf
  10. snd_seq_client_enqueue_event, kernel_client_enqueue, snd_seq_fifo_event_in, snd_seq_cell_alloc and snd_seq_event_dup functions from kernel/sound/core/seq/seq_clientmgr.c, kernel/sound/core/seq/seq_fifo.c and kernel/sound/core/seq/seq_memory.c respectively, which shares the similarity with CVE-2018-1000004 and the patch is torvalds/linux@7bd8009
  11. ext4_read_inode_bitmap and ext4_read_block_bitmap functions from kernel/fs/ext4/ialloc.c and kernel/fs/ext4/balloc.c respectively, which shares the similarity with CVE-2018-1093 and the patch is torvalds/linux@7dac4a1
  12. ext4_mb_add_groupinfo and ext4_has_uninit_itable functions from kernel/fs/ext4/mballoc.c and kernel/fs/ext4/super.c respectively, which shares the similarity with CVE-2018-10876 and the patch is torvalds/linux@8844618
  13. __ext4_get_inode_loc functions from kernel/fs/ext4/inode.c, which shares the similarity with CVE-2018-10882 and the patch is torvalds/linux@c37e9e0
  14. flush_ldt, init_new_context, alloc_ldt, copy_ldt and convert_ip_to_linear functions from kernel/arch/x86/kernel/ldt.c and kernel/arch/x86/kernel/step.c respectively, which shares the similarity with CVE-2015-5157 and the patch is torvalds/linux@37868fe
  15. create_kthread from kernel/kernel/kthread.c, which shares the similarity with CVE-2012-4398 and the patch is torvalds/linux@786235e
  16. cypress_open from kernel/drivers/usb/serial/cypress_m8.c, which shares the similarity with CVE-2016-3137 and the patch is torvalds/linux@c55aee1
  17. gru_handle_user_call_os and gru_check_context_placement functions from kernel/drivers/misc/sgi-gru/grufault.c and kernel/drivers/misc/sgi-gru/grumain.c respectively, which shares the similarity with CVE-2022-3424 and the patch is torvalds/linux@643a16a
  18. rose_start_idletimer from ernel/net/rose/rose_timer.c, which shares the similarity with CVE-2022-2318 and the patch is torvalds/linux@9cc02ed
  19. ext4_xattr_ibody_find and ext3_xattr_ibody_find functions from kernel/fs/ext4/xattr.c and kernel/fs/ext3/xattr.c respectively, which shares the similarity with CVE-2023-2513 and the patch is torvalds/linux@67d7d8ad99be
  20. fib6_rule_action function from kernel/net/ipv6/fib6_rules.c, which shares the similarity with CVE-2023-3022 and the patch is torvalds/linux@a65120bae4b7
    We have preliminarily verified the correctness of the above list through static analysis. Would you can help to check if this bug is true? If it's true, please try to fix it, or I'd like to open a PR for that if necessary. Thank you for your effort and patience!

Connection reset by peer for demo server

Hi,

I am running demo server to test fastsocket. The client I am using is ab benchmark.
The server works fine in the normal kernel mode. However, when I run it with LD_PRELOAD of faastsocket.so, it handles a single burst of packets and then at ab I get connection reset by peer. Can you please help me resolve this issue.

How about fastsocket on VM?

Hello,

Do you think that there is an interest to deploy a fastsocket on a virtualized environnement ? (such as KVM) or on the host system ?

Perhaps you could try to run some benchmarks in these types of environnement ?

A last question: you wrote "Swith kernel : change grub file to (...)", could you explain ? what file ? (grub.cfg ?) and what should I modify ? :)

Thanks

Regards

Need confirmation for some unpatched CVE

I'm cloning this repo to make some modifications to customize. However, I've noticed that some CVEs which were confirmed and fixed by linux do not get patched in this repo. To enhance the availability of my project as far as possible, I will appreciate it if any of the CVE below do exist in this repo as well, so that I can fix these security issue myself by applying the corresponding patch.
Here are the CVEs I found in this repo unpatched, but get fixed in linux:

CVE-2011-1161 in kernel/drivers/char/tpm/tpm.c's function static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf, size_t bufsiz), with patch here for your reference.

CVE-2022-2639 in kernel/net/openvswitch/datapath.c's function static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa, int attr_len), with patch here for your reference.

CVE-2020-9383 in kernel/drivers/block/floppy.c's function static void set_fdc(int drive), with patch here for your reference.

CVE-2017-8824 in kernel/net/dccp/proto.c's function int dccp_disconnect(struct sock *sk, int flags), with patch here for your reference.

CVE-2019-7222 in kernel/arch/x86/kvm/x86.c's function static int kvm_read_guest_virt_helper(gva_t addr, void *val, unsigned int bytes, struct kvm_vcpu *vcpu, u32 access, u32 *error), with patch here for your reference.

CVE-2013-4587 in kernel/virt/kvm/kvm_main.c's function static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id), with patch here for your reference.

Compile module with newer kernel

Hi!
How to compile fastsocket module with newer kernel?
I copied files from net/fastsocket to /path/to/kernel/net and builded but modprobe fastsocket says there is now such module and i can't find it in make menuconfig.
I'm not so familiar with kernel build.

eventpoll_release_file的rcu释放是否有问题

list_for_each_entry_rcu(epi, &file->f_ep_links, fllink) {
ep = epi->ep;
mutex_lock(&ep->mtx);
ep_remove(ep, epi);
mutex_unlock(&ep->mtx);
}
如果不调用epoll_ctl DEL,直接close fd,那从close调用到此函数,

  1. 这里没有在rcu_read_lock包含?
  2. 这里不是list_for_each_safe, ep_remove会造成断链?

个人建议

可不可以做成像网卡驱动一样的kernel module 。这样不用每次编译kernel更新kernel才可以使用。这个不适合批量部署,不太方便的呢。

Mailing list problem

Hi, everybody:
Recently, there is something wrong with the Fastsocket mailing list hosted on librelist.com, that is post can not be receive from the mailing list... Then, please contact us with Github Issue instead of the mailing list for the moment and I hope we did not lost any post during the failure.

请教 fastsocket and reuseport

请问下fastsocket内核,应用层我能否跑带reuseport功能的程序?我这边有台机器带reuseport功能的程序启动不大正常,本来是要启动16个进程,只起来3-4个。

FastSocket for CentOS7?

hello,
FastSocket现在的版本好像只支持到CentOS6.5;我想了解一下支持CentOS7计划是怎样的?谢谢!

centos 6.8使用fastsocket

@gfreewind 你好,请问kernel-2.6.32-642能否使用fastsocket呢?如果可以的话,是不是只需要编译 library和module目录的东东就可以?

TCP early demux

Upstream already supports early demux, for a long time. :)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.