[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <14d383ebd61980ecf07430255a2de730257d3dde.camel@nvidia.com>
Date: Mon, 20 May 2024 10:06:24 +0000
From: Jianbo Liu <jianbol@...dia.com>
To: "edumazet@...gle.com" <edumazet@...gle.com>
CC: Leon Romanovsky <leonro@...dia.com>, "netdev@...r.kernel.org"
<netdev@...r.kernel.org>, "steffen.klassert@...unet.com"
<steffen.klassert@...unet.com>, "fw@...len.de" <fw@...len.de>
Subject: Re: [PATCH net] net: drop secpath extension before skb deferral free
On Tue, 2024-05-14 at 10:51 +0200, Eric Dumazet wrote:
> On Tue, May 14, 2024 at 9:37 AM Jianbo Liu <jianbol@...dia.com>
> wrote:
> >
> > On Mon, 2024-05-13 at 12:29 +0200, Eric Dumazet wrote:
> > > On Mon, May 13, 2024 at 12:04 PM Jianbo Liu <jianbol@...dia.com>
> > > wrote:
> > >
> > >
...
> > > This attribution and patch seem wrong. Also you should CC XFRM
> > > maintainers.
> > >
> > > Before being freed from tcp_recvmsg() path, packets can sit in
> > > TCP
> > > receive queues for arbitrary amounts of time.
> > >
> > > secpath_reset() should be called much earlier than in the code
> > > you
> > > tried to change.
> >
> > Yes, this also fixed the issue if I moved secpatch_reset() before
> > tcp_v4_do_rcv().
> >
> > --- a/net/ipv4/tcp_ipv4.c
> > +++ b/net/ipv4/tcp_ipv4.c
> > @@ -2314,6 +2314,7 @@ int tcp_v4_rcv(struct sk_buff *skb)
> > tcp_v4_fill_cb(skb, iph, th);
> >
> > skb->dev = NULL;
> > + secpath_reset(skb);
> >
> > if (sk->sk_state == TCP_LISTEN) {
> > ret = tcp_v4_do_rcv(sk, skb);
> >
> > Do you want me to send v2, or push a new one if you agree with this
> > change?
>
> That would only care about TCP and IPv4.
>
> I think we need a full fix, not a partial work around to an immediate
> problem.
>
> Can we have some feedback from Steffen, I wonder if we missed
> something really obvious.
>
> It is hard to believe this has been broken for such a long time.
Could you please give me some suggestions?
Should I add new function to reset both ct and secpath, and replace
nf_reset_ct() where necessary on receive flow?
>
> I think the issue came with
>
> commit d77e38e612a017480157fe6d2c1422f42cb5b7e3
> Author: Steffen Klassert <steffen.klassert@...unet.com>
> Date: Fri Apr 14 10:06:10 2017 +0200
>
> xfrm: Add an IPsec hardware offloading API
>
> This patch adds all the bits that are needed to do
> IPsec hardware offload for IPsec states and ESP packets.
> We add xfrmdev_ops to the net_device. xfrmdev_ops has
> function pointers that are needed to manage the xfrm
> states in the hardware and to do a per packet
> offloading decision.
>
> Joint work with:
> Ilan Tayari <ilant@...lanox.com>
> Guy Shapiro <guysh@...lanox.com>
> Yossi Kuperman <yossiku@...lanox.com>
>
> Signed-off-by: Guy Shapiro <guysh@...lanox.com>
> Signed-off-by: Ilan Tayari <ilant@...lanox.com>
> Signed-off-by: Yossi Kuperman <yossiku@...lanox.com>
> Signed-off-by: Steffen Klassert <steffen.klassert@...unet.com>
>
> We should probably handle NETDEV_DOWN/NETDEV_UNREGISTER better,
> instead of adding secpath_reset(skb) there and there.
Powered by blists - more mailing lists