netdev - Re: [PATCH net V3 1/3] bonding: implement xdo_dev_state

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <14564f4a8e00ecfa149ef1712d06950802e72605.camel@nvidia.com>
Date: Tue, 13 Aug 2024 02:58:12 +0000
From: Jianbo Liu <jianbol@...dia.com>
To: Tariq Toukan <tariqt@...dia.com>, "kuba@...nel.org" <kuba@...nel.org>
CC: "liuhangbin@...il.com" <liuhangbin@...il.com>, "davem@...emloft.net"
	<davem@...emloft.net>, "andy@...yhouse.net" <andy@...yhouse.net>, Gal
 Pressman <gal@...dia.com>, "jv@...sburgh.net" <jv@...sburgh.net>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>, "pabeni@...hat.com"
	<pabeni@...hat.com>, "edumazet@...gle.com" <edumazet@...gle.com>, Saeed
 Mahameed <saeedm@...dia.com>, Leon Romanovsky <leonro@...dia.com>
Subject: Re: [PATCH net V3 1/3] bonding: implement xdo_dev_state_free and call
 it after deletion

On Mon, 2024-08-12 at 17:48 -0700, Jakub Kicinski wrote:
> On Mon, 5 Aug 2024 08:03:55 +0300 Tariq Toukan wrote:
> > +static void bond_ipsec_free_sa(struct xfrm_state *xs)
> > +{
> > +       struct net_device *bond_dev = xs->xso.dev;
> > +       struct net_device *real_dev;
> > +       struct bonding *bond;
> > +       struct slave *slave;
> > +
> > +       if (!bond_dev)
> > +               return;
> 
> can xs->xso.dev be NULL during the dev_free_state callback?

Shouldn't be NULL because bond_ipsec_del_sa is called before and xs is
removed from bond->ipsec_list, so xs->xso.dev is kept unless it's
cleared in dev's xdo_dev_state_delete callback.

> 
> > +       rcu_read_lock();
> > +       bond = netdev_priv(bond_dev);
> > +       slave = rcu_dereference(bond->curr_active_slave);
> > +       real_dev = slave ? slave->dev : NULL;
> > +       rcu_read_unlock();
> 
> What's holding onto real_dev once you drop the rcu lock here?

I think it should be xfrm state (and bond device).

Thanks!
Jianbo