netdev - Re: [PATCH net-next 09/10] net/mlx5e: Create IPsec table with tunnel support only when encap is disabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZDQdNV+SRG6EVYlJ@corigine.com>
Date:   Mon, 10 Apr 2023 16:29:09 +0200
From:   Simon Horman <simon.horman@...igine.com>
To:     Leon Romanovsky <leon@...nel.org>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>,
        Leon Romanovsky <leonro@...dia.com>,
        Steffen Klassert <steffen.klassert@...unet.com>,
        Herbert Xu <herbert@...dor.apana.org.au>,
        netdev@...r.kernel.org, Saeed Mahameed <saeedm@...dia.com>,
        Raed Salem <raeds@...dia.com>, Emeel Hakim <ehakim@...dia.com>
Subject: Re: [PATCH net-next 09/10] net/mlx5e: Create IPsec table with tunnel
 support only when encap is disabled

On Mon, Apr 10, 2023 at 09:19:11AM +0300, Leon Romanovsky wrote:
> From: Leon Romanovsky <leonro@...dia.com>
> 
> Current hardware doesn't support double encapsulation which is
> happening when IPsec packet offload tunnel mode is configured
> together with eswitch encap option.
> 
> Any user attempt to add new SA/policy after he/she sets encap mode, will
> generate the following FW syndrome:
> 
>  mlx5_core 0000:08:00.0: mlx5_cmd_out_err:803:(pid 1904): CREATE_FLOW_TABLE(0x930) op_mod(0x0) failed,
>  status bad parameter(0x3), syndrome (0xa43321), err(-22)
> 
> Make sure that we block encap changes before creating flow steering tables.
> This is applicable only for packet offload in tunnel mode, while packet
> offload in transport mode and crypto offload, don't have such limitation
> as they don't perform encapsulation.
> 
> Reviewed-by: Raed Salem <raeds@...dia.com>
> Signed-off-by: Leon Romanovsky <leonro@...dia.com>

Hi Raed and Leon,

some minor feedback from me below.

> ---
>  .../mellanox/mlx5/core/en_accel/ipsec.c       |  7 ++++
>  .../mellanox/mlx5/core/en_accel/ipsec.h       |  1 +
>  .../mellanox/mlx5/core/en_accel/ipsec_fs.c    | 33 +++++++++++++++++--
>  3 files changed, 38 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> index b64281fd4142..e95004ac7a20 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> @@ -668,6 +668,13 @@ static int mlx5e_xfrm_add_state(struct xfrm_state *x,
>  	if (err)
>  		goto err_hw_ctx;
>  
> +	if (x->props.mode == XFRM_MODE_TUNNEL &&
> +	    x->xso.type == XFRM_DEV_OFFLOAD_PACKET &&
> +	    !mlx5e_ipsec_fs_tunnel_enabled(sa_entry)) {
> +		NL_SET_ERR_MSG_MOD(extack, "Packet offload tunnel mode is disabled due to encap settings");
> +		goto err_add_rule;

The err_add_rule will return err.
But err is zero here.
Perhaps it should be set to an negative error code?

Flagged by Smatch as:

drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c:753 mlx5e_xfrm_free_state() error: we previously assumed 'sa_entry->work' could be null (see line 744)

> +	}
> +
>  	/* We use *_bh() variant because xfrm_timer_handler(), which runs
>  	 * in softirq context, can reach our state delete logic and we need
>  	 * xa_erase_bh() there.

...