From patchwork Tue Nov 17 20:33:54 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Saeed Mahameed X-Patchwork-Id: 11913529 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6F086C2D0E4 for ; Tue, 17 Nov 2020 20:38:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 09891222E9 for ; Tue, 17 Nov 2020 20:38:33 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=nvidia.com header.i=@nvidia.com header.b="JSFCpBdV" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727524AbgKQUiN (ORCPT ); Tue, 17 Nov 2020 15:38:13 -0500 Received: from hqnvemgate25.nvidia.com ([216.228.121.64]:9043 "EHLO hqnvemgate25.nvidia.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726020AbgKQUiM (ORCPT ); Tue, 17 Nov 2020 15:38:12 -0500 Received: from hqmail.nvidia.com (Not Verified[216.228.121.13]) by hqnvemgate25.nvidia.com (using TLS: TLSv1.2, AES256-SHA) id ; Tue, 17 Nov 2020 12:38:02 -0800 Received: from sx1.mtl.com (172.20.13.39) by HQMAIL107.nvidia.com (172.20.187.13) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 17 Nov 2020 20:38:01 +0000 From: Saeed Mahameed To: Jakub Kicinski CC: , "David S. Miller" , "Maxim Mikityanskiy" , Saeed Mahameed Subject: [PATCH net 1/2] net/tls: Protect from calling tls_dev_del for TLS RX twice Date: Tue, 17 Nov 2020 12:33:54 -0800 Message-ID: <20201117203355.389661-1-saeedm@nvidia.com> X-Mailer: git-send-email 2.26.2 MIME-Version: 1.0 X-Originating-IP: [172.20.13.39] X-ClientProxiedBy: HQMAIL107.nvidia.com (172.20.187.13) To HQMAIL107.nvidia.com (172.20.187.13) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nvidia.com; s=n1; t=1605645482; bh=4Ch/Wg6AoY2f8JHpAMaRUFIVmUSPWpsqb0k6D9cNgew=; h=From:To:CC:Subject:Date:Message-ID:X-Mailer:MIME-Version: Content-Transfer-Encoding:Content-Type:X-Originating-IP: X-ClientProxiedBy; b=JSFCpBdVtGoNTYaU8wghki7EGYApagxfCa5KEINED+hYEHU9BeIvqpWNRctdYZPpy lAPG2bS8+dai6h3PKEHBuoCYmhMIo5hcrn4akGBpVMZJg1/brJIKVQWjQ0H/Mt37XN QTtRyUGHvvrOLNpJKQPpagu7LRV+5AWsLBQREccgjNhMHu0JN7yF7/hY8ne8afNcv+ 8LacHPE26NwtDYhlnO7W5kwNk8Grlq+F81X2kWsiIrcbEtSsbbNJwz2m40/0Oc9pla lv+oO51MQV2caKdhBbwWDPHz4MKgXRH9q9rlKq+g/XLnHBQK4JD3eXeyimybaFLLKp emC/t+R5uoYMA== Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org From: Maxim Mikityanskiy tls_device_offload_cleanup_rx doesn't clear tls_ctx->netdev after calling tls_dev_del if TLX TX offload is also enabled. Clearing tls_ctx->netdev gets postponed until tls_device_gc_task. It leaves a time frame when tls_device_down may get called and call tls_dev_del for RX one extra time, confusing the driver, which may lead to a crash. This patch corrects this racy behavior by adding a flag to prevent tls_device_down from calling tls_dev_del the second time. Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure") Signed-off-by: Maxim Mikityanskiy Signed-off-by: Saeed Mahameed --- For -stable: 5.3 include/net/tls.h | 1 + net/tls/tls_device.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/include/net/tls.h b/include/net/tls.h index baf1e99d8193..a0deddfde412 100644 --- a/include/net/tls.h +++ b/include/net/tls.h @@ -199,6 +199,7 @@ enum tls_context_flags { * to be atomic. */ TLS_TX_SYNC_SCHED = 1, + TLS_RX_DEV_RELEASED = 2, }; struct cipher_context { diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c index cec86229a6a0..b2261caac6be 100644 --- a/net/tls/tls_device.c +++ b/net/tls/tls_device.c @@ -1241,6 +1241,7 @@ void tls_device_offload_cleanup_rx(struct sock *sk) netdev->tlsdev_ops->tls_dev_del(netdev, tls_ctx, TLS_OFFLOAD_CTX_DIR_RX); + set_bit(TLS_RX_DEV_RELEASED, &tls_ctx->flags); if (tls_ctx->tx_conf != TLS_HW) { dev_put(netdev); @@ -1274,7 +1275,7 @@ static int tls_device_down(struct net_device *netdev) if (ctx->tx_conf == TLS_HW) netdev->tlsdev_ops->tls_dev_del(netdev, ctx, TLS_OFFLOAD_CTX_DIR_TX); - if (ctx->rx_conf == TLS_HW) + if (ctx->rx_conf == TLS_HW && !test_bit(TLS_RX_DEV_RELEASED, &ctx->flags)) netdev->tlsdev_ops->tls_dev_del(netdev, ctx, TLS_OFFLOAD_CTX_DIR_RX); WRITE_ONCE(ctx->netdev, NULL); From patchwork Tue Nov 17 20:33:55 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Saeed Mahameed X-Patchwork-Id: 11913531 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B05B1C63697 for ; Tue, 17 Nov 2020 20:38:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 405AD2417E for ; Tue, 17 Nov 2020 20:38:34 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=nvidia.com header.i=@nvidia.com header.b="M4RN4hJE" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726752AbgKQUiM (ORCPT ); Tue, 17 Nov 2020 15:38:12 -0500 Received: from hqnvemgate25.nvidia.com ([216.228.121.64]:9042 "EHLO hqnvemgate25.nvidia.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725943AbgKQUiM (ORCPT ); Tue, 17 Nov 2020 15:38:12 -0500 Received: from hqmail.nvidia.com (Not Verified[216.228.121.13]) by hqnvemgate25.nvidia.com (using TLS: TLSv1.2, AES256-SHA) id ; Tue, 17 Nov 2020 12:38:02 -0800 Received: from sx1.mtl.com (172.20.13.39) by HQMAIL107.nvidia.com (172.20.187.13) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 17 Nov 2020 20:38:02 +0000 From: Saeed Mahameed To: Jakub Kicinski CC: , "David S. Miller" , "Maxim Mikityanskiy" , Tariq Toukan , "Saeed Mahameed" Subject: [PATCH net 2/2] net: Call skb destructor on NAPI_GRO_FREE_STOLEN_HEAD Date: Tue, 17 Nov 2020 12:33:55 -0800 Message-ID: <20201117203355.389661-2-saeedm@nvidia.com> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20201117203355.389661-1-saeedm@nvidia.com> References: <20201117203355.389661-1-saeedm@nvidia.com> MIME-Version: 1.0 X-Originating-IP: [172.20.13.39] X-ClientProxiedBy: HQMAIL107.nvidia.com (172.20.187.13) To HQMAIL107.nvidia.com (172.20.187.13) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nvidia.com; s=n1; t=1605645482; bh=n6upADOkEb84x8Lz5LHj4EtwzD79V71n+AkP7zRGTws=; h=From:To:CC:Subject:Date:Message-ID:X-Mailer:In-Reply-To: References:MIME-Version:Content-Transfer-Encoding:Content-Type: X-Originating-IP:X-ClientProxiedBy; b=M4RN4hJExq5jFhWomTl6Exq2UodYfhFtzLfHgV3PIhES6kYrTOMftwdpGAZ6ZbUR5 8FKRAnh7qx7xVBCsM4avBMnWqojkGr/cp/VF3zX+8QRmw2y82cjmLdgrrrxrNlhDok lAtRTk4ewQijmFYdxKO+V9IY7YX8iM0L/YUDUjSswQLivIA7zweOZ5v434amDnmfBV h7STQr7jntM39sRwx7bQo01PjuGZIZMPtge/yXtm5mc7bB/adRYOB4GhdWJU9+b1gX a1QR+g8gRhtSb0VSwRmNQQ7rkFzK54s+eKQSrhqqpUieBR+I16PuJZQoM3E4c8xegx 87y/3mQsuJRvg== Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org From: Maxim Mikityanskiy All GRO flows except one call skb->destructor, however, GRO_MERGED_FREE doesn't do it in case of NAPI_GRO_FREE_STOLEN_HEAD. For better consistency and to add resiliency against the drivers that may pass SKBs with a destructor, this patch changes napi_skb_free_stolen_head to use skb_release_head_state, which should perform all the needed cleanups, including a call to the destructor. This way the code of GRO_MERGED_FREE becomes similar to kfree_skb_partial. Fixes: e44699d2c280 ("net: handle NAPI_GRO_FREE_STOLEN_HEAD case also in napi_frags_finish()") Fixes: d7e8883cfcf4 ("net: make GRO aware of skb->head_frag") Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed --- For -stable: 5.4 net/core/dev.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/net/core/dev.c b/net/core/dev.c index 82dc6b48e45f..85dcc7f19902 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -6048,8 +6048,7 @@ EXPORT_SYMBOL(gro_find_complete_by_type); static void napi_skb_free_stolen_head(struct sk_buff *skb) { - skb_dst_drop(skb); - skb_ext_put(skb); + skb_release_head_state(skb); kmem_cache_free(skbuff_head_cache, skb); }