netdev - Re: [PATCH net] net: drop secpath extension before skb deferral free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e6f70384717d85fb1604566530afd02a594f427f.camel@nvidia.com>
Date: Tue, 28 May 2024 09:02:49 +0000
From: Jianbo Liu <jianbol@...dia.com>
To: "steffen.klassert@...unet.com" <steffen.klassert@...unet.com>
CC: Leon Romanovsky <leonro@...dia.com>, "edumazet@...gle.com"
	<edumazet@...gle.com>, "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"fw@...len.de" <fw@...len.de>
Subject: Re: [PATCH net] net: drop secpath extension before skb deferral free

On Tue, 2024-05-28 at 10:44 +0200, Steffen Klassert wrote:
> On Mon, May 27, 2024 at 09:40:23AM +0200, Steffen Klassert wrote:
> > On Thu, May 23, 2024 at 03:26:22PM +0000, Jianbo Liu wrote:
> > > On Thu, 2024-05-23 at 12:00 +0200, Steffen Klassert wrote:
> > > > 
> > > > Hm, interesting.
> > > > 
> > > > Can you check if xfrm_dev_state_free() is triggered in that
> > > > codepath
> > > > and if it actually removes the device from the states?
> > > > 
> > > 
> > > xfrm_dev_state_free is not triggered. I think it's because I did
> > > "ip x
> > > s delall" before unregister netdev.
> > 
> > Yes, likely. So we can't defer the device removal to the state free
> > functions, we always need to do that on state delete.
> 
> The only (not too complicated) solution I see so far is to
> free the device early, along with the state delete function:
> 
> diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
> index 649bb739df0d..bfc71d2daa6a 100644
> --- a/net/xfrm/xfrm_state.c
> +++ b/net/xfrm/xfrm_state.c
> @@ -721,6 +721,7 @@ int __xfrm_state_delete(struct xfrm_state *x)
>                         sock_put(rcu_dereference_raw(x->encap_sk));
>  
>                 xfrm_dev_state_delete(x);
> +               xfrm_dev_state_free(x);
>  

Still hit "scheduling while atomic" issue because __xfrm_state_delete
is called in state's spin lock. 

>                 /* All xfrm_state objects are created by
> xfrm_state_alloc.
>                  * The xfrm_state_alloc call gives a reference, and
> that