netdev - RE: [EXT] Re: Are xfrm state_add/delete() calls serialized?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 21 Sep 2022 05:42:22 +0000
From:   Bharat Bhushan <bbhushan2@...vell.com>
To:     Leon Romanovsky <leon@...nel.org>
CC:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: RE: [EXT] Re: Are xfrm state_add/delete() calls serialized?

Please see inline 

> -----Original Message-----
> From: Leon Romanovsky <leon@...nel.org>
> Sent: Monday, September 19, 2022 3:00 PM
> To: Bharat Bhushan <bbhushan2@...vell.com>
> Cc: netdev@...r.kernel.org
> Subject: [EXT] Re: Are xfrm state_add/delete() calls serialized?
> 
> External Email
> 
> ----------------------------------------------------------------------
> On Mon, Sep 12, 2022 at 03:10:12PM +0000, Bharat Bhushan wrote:
> > Hi All,
> >
> > Have a very basic query related to .xdo_dev_state_add()/delete() ops
> supported by netdev driver. Can .xdo_dev_state_add()/delete() execute from
> other core while already in process of handling .xdo_dev_state_add()/delete()
> on one core? Or these calls are always serialized by stack?
> 
> It is protected from userspace callers with xfrm_cfg_mutex in xfrm_netlink_rcv().

So all *_state_add() and _state_delete() are serialized from user.

> However, stack triggered deletion can be in parallel. There is a lock for that
> specific SA that is going to be deleted, and it is not global.

Just want to confirm m understanding, xfrm_state->lock is used by stack (example xfrm_timer_handler()) for deletion, but this lock is per SA (not global).
So _state_delete() of different SA can happen in parallel and also _state_delete() by stack can run in parallel to state addition from user.

Thanks
-Bharat

> 
> > Wanted to know if we need proper locking while handling these ops in driver.
> >
> > Thanks
> > -Bharat