netdev - Re: [PATCH net 2/2] nfp: reject binding to shared blocks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 25 Jun 2018 22:40:21 +0200
From:   Jiri Pirko <jiri@...nulli.us>
To:     Jakub Kicinski <jakub.kicinski@...ronome.com>
Cc:     davem@...emloft.net, oss-drivers@...ronome.com,
        netdev@...r.kernel.org, John Hurley <john.hurley@...ronome.com>
Subject: Re: [PATCH net 2/2] nfp: reject binding to shared blocks

Mon, Jun 25, 2018 at 10:22:46PM CEST, jakub.kicinski@...ronome.com wrote:
>From: John Hurley <john.hurley@...ronome.com>
>
>TC shared blocks allow multiple qdiscs to be grouped together and filters
>shared between them. Currently the chains of filters attached to a block
>are only flushed when the block is removed. If a qdisc is removed from a
>block but the block still exists, flow del messages are not passed to the
>callback registered for that qdisc. For the NFP, this presents the
>possibility of rules still existing in hw when they should be removed.
>
>Prevent binding to shared blocks until the kernel can send per qdisc del
>messages when block unbinds occur.

This is not nfp-specific problem. Should be handled differently. The
driver has information about offloaded filters. On unbind, it have
enough info to do the flush, doesn't it?


>
>Fixes: 4861738775d7 ("net: sched: introduce shared filter blocks infrastructure")
>Signed-off-by: John Hurley <john.hurley@...ronome.com>
>Signed-off-by: Jakub Kicinski <jakub.kicinski@...ronome.com>
>Reviewed-by: Simon Horman <simon.horman@...ronome.com>
>---
> drivers/net/ethernet/netronome/nfp/bpf/main.c       | 3 +++
> drivers/net/ethernet/netronome/nfp/flower/offload.c | 3 +++
> 2 files changed, 6 insertions(+)
>
>diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.c b/drivers/net/ethernet/netronome/nfp/bpf/main.c
>index fcdfb8e7fdea..6b15e3b11956 100644
>--- a/drivers/net/ethernet/netronome/nfp/bpf/main.c
>+++ b/drivers/net/ethernet/netronome/nfp/bpf/main.c
>@@ -202,6 +202,9 @@ static int nfp_bpf_setup_tc_block(struct net_device *netdev,
> 	if (f->binder_type != TCF_BLOCK_BINDER_TYPE_CLSACT_INGRESS)
> 		return -EOPNOTSUPP;
> 
>+	if (tcf_block_shared(f->block))
>+		return -EOPNOTSUPP;
>+
> 	switch (f->command) {
> 	case TC_BLOCK_BIND:
> 		return tcf_block_cb_register(f->block,
>diff --git a/drivers/net/ethernet/netronome/nfp/flower/offload.c b/drivers/net/ethernet/netronome/nfp/flower/offload.c
>index 477f584f6d28..525057bee0ed 100644
>--- a/drivers/net/ethernet/netronome/nfp/flower/offload.c
>+++ b/drivers/net/ethernet/netronome/nfp/flower/offload.c
>@@ -631,6 +631,9 @@ static int nfp_flower_setup_tc_block(struct net_device *netdev,
> 	if (f->binder_type != TCF_BLOCK_BINDER_TYPE_CLSACT_INGRESS)
> 		return -EOPNOTSUPP;
> 
>+	if (tcf_block_shared(f->block))
>+		return -EOPNOTSUPP;
>+
> 	switch (f->command) {
> 	case TC_BLOCK_BIND:
> 		return tcf_block_cb_register(f->block,
>-- 
>2.17.1
>