netdev - Re: [PATCH net 0/2] Fix police 'continue' action offload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 7 Jul 2022 10:33:32 +0100
From:   Simon Horman <simon.horman@...igine.com>
To:     Vlad Buslov <vladbu@...dia.com>
Cc:     davem@...emloft.net, kuba@...nel.org, saeedm@...dia.com,
        vladimir.oltean@....com, claudiu.manoil@....com,
        alexandre.belloni@...tlin.com, rajur@...lsio.com,
        sgoutham@...vell.com, gakula@...vell.com, sbhatta@...vell.com,
        hkelam@...vell.com, jianbol@...dia.com, idosch@...dia.com,
        xiyou.wangcong@...il.com, jhs@...atatu.com, jiri@...nulli.us,
        netdev@...r.kernel.org, maord@...dia.com, oss-drivers@...igine.com
Subject: Re: [PATCH net 0/2] Fix police 'continue' action offload

+ oss-drivers@...igine.com

On Wed, Jul 06, 2022 at 12:57:48PM +0300, Vlad Buslov wrote:
> On Mon 04 Jul 2022 at 22:44, Vlad Buslov <vladbu@...dia.com> wrote:
> > TC act_police with 'continue' action had been supported by mlx5 matchall
> > classifier offload implementation for some time. However, 'continue' was
> > assumed implicitly and recently got broken in multiple places. Fix it in
> > both TC hardware offload validation code and mlx5 driver.
> >
> > Vlad Buslov (2):
> >   net/sched: act_police: allow 'continue' action offload
> >   net/mlx5e: Fix matchall police parameters validation
> >
> >  drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 13 ++++++-------
> >  include/net/flow_offload.h                      |  1 +
> >  net/sched/act_police.c                          |  2 +-
> >  3 files changed, 8 insertions(+), 8 deletions(-)
> 
> Adding maintainers of other drivers that might have been impacted by the
> validation change. If your driver supports 'continue' police action
> offload with matchall classifier, then you may want to also relax the
> validation restrictions in similar manner as I do in patch 2 for mlx5,
> as I also submitted OvS fix to restore matchall police notexceed action
> type to 'continue' here:
> https://mail.openvswitch.org/pipermail/ovs-dev/2022-July/395561.html

Thanks Vlad,

I've looked through the nfp driver and it appears that
nfp_policer_validate() rejects policer offload if the
conform/exceed action (act_id) is not FLOW_ACTION_DROP.

So I think it will not be affected by any new valid values for act_id.
And thus this patchset, which adds FLOW_ACTION_CONTINUE as a valid
value for act_id should not affect the nfp driver.

For patch 1/2:

Reviewed-by: Simon Horman <simon.horman@...igine.com>