Skip to content

L
linux
Commit 2fecbf75 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files
Options

Merge branch 'fixes-for-ipsec-over-bonding' 

Jianbo Liu says:

====================
Fixes for IPsec over bonding

This patchset provides bug fixes for IPsec over bonding driver.

It adds the missing xdo_dev_state_free API, and fixes "scheduling while
atomic" by using mutex lock instead.

Series generated against:
commit c07ff859 ("netem: fix return value if duplicate enqueue fails")
====================

Link: https://patch.msgid.link/20240823031056.110999-1-jianbol@nvidia.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 65a3cce4 2aeeef90
Hide whitespace changes
Inline Side-by-side
Showing with 106 additions and 55 deletions
drivers/net/bonding/bond_main.c
View file @ 2fecbf75
...@@ -427,6 +427,8 @@ static int bond_ipsec_add_sa(struct xfrm_state *xs, ...@@ -427,6 +427,8 @@ static int bond_ipsec_add_sa(struct xfrm_state *xs,
struct netlink_ext_ack *extack) struct netlink_ext_ack *extack)
{ {
struct net_device *bond_dev = xs->xso.dev; struct net_device *bond_dev = xs->xso.dev;
struct net_device *real_dev;
netdevice_tracker tracker;
struct bond_ipsec *ipsec; struct bond_ipsec *ipsec;
struct bonding *bond; struct bonding *bond;
struct slave *slave; struct slave *slave;
...@@ -438,74 +440,80 @@ static int bond_ipsec_add_sa(struct xfrm_state *xs, ...@@ -438,74 +440,80 @@ static int bond_ipsec_add_sa(struct xfrm_state *xs,
rcu_read_lock(); rcu_read_lock();
bond = netdev_priv(bond_dev); bond = netdev_priv(bond_dev);
slave = rcu_dereference(bond->curr_active_slave); slave = rcu_dereference(bond->curr_active_slave);
if (!slave) { real_dev = slave ? slave->dev : NULL;
rcu_read_unlock(); netdev_hold(real_dev, &tracker, GFP_ATOMIC);
return -ENODEV; rcu_read_unlock();
if (!real_dev) {
err = -ENODEV;
goto out;
} }
if (!slave->dev->xfrmdev_ops || if (!real_dev->xfrmdev_ops ||
!slave->dev->xfrmdev_ops->xdo_dev_state_add || !real_dev->xfrmdev_ops->xdo_dev_state_add ||
netif_is_bond_master(slave->dev)) { netif_is_bond_master(real_dev)) {
NL_SET_ERR_MSG_MOD(extack, "Slave does not support ipsec offload"); NL_SET_ERR_MSG_MOD(extack, "Slave does not support ipsec offload");
rcu_read_unlock(); err = -EINVAL;
return -EINVAL; goto out;
} }
ipsec = kmalloc(sizeof(*ipsec), GFP_ATOMIC); ipsec = kmalloc(sizeof(*ipsec), GFP_KERNEL);
if (!ipsec) { if (!ipsec) {
rcu_read_unlock(); err = -ENOMEM;
return -ENOMEM; goto out;
} }
xs->xso.real_dev = slave->dev;
err = slave->dev->xfrmdev_ops->xdo_dev_state_add(xs, extack); xs->xso.real_dev = real_dev;
err = real_dev->xfrmdev_ops->xdo_dev_state_add(xs, extack);
if (!err) { if (!err) {
ipsec->xs = xs; ipsec->xs = xs;
INIT_LIST_HEAD(&ipsec->list); INIT_LIST_HEAD(&ipsec->list);
spin_lock_bh(&bond->ipsec_lock); mutex_lock(&bond->ipsec_lock);
list_add(&ipsec->list, &bond->ipsec_list); list_add(&ipsec->list, &bond->ipsec_list);
spin_unlock_bh(&bond->ipsec_lock); mutex_unlock(&bond->ipsec_lock);
} else { } else {
kfree(ipsec); kfree(ipsec);
} }
rcu_read_unlock(); out:
netdev_put(real_dev, &tracker);
return err; return err;
} }
static void bond_ipsec_add_sa_all(struct bonding *bond) static void bond_ipsec_add_sa_all(struct bonding *bond)
{ {
struct net_device *bond_dev = bond->dev; struct net_device *bond_dev = bond->dev;
struct net_device *real_dev;
struct bond_ipsec *ipsec; struct bond_ipsec *ipsec;
struct slave *slave; struct slave *slave;
rcu_read_lock(); slave = rtnl_dereference(bond->curr_active_slave);
slave = rcu_dereference(bond->curr_active_slave); real_dev = slave ? slave->dev : NULL;
if (!slave) if (!real_dev)
goto out; return;
if (!slave->dev->xfrmdev_ops || mutex_lock(&bond->ipsec_lock);
!slave->dev->xfrmdev_ops->xdo_dev_state_add || if (!real_dev->xfrmdev_ops ||
netif_is_bond_master(slave->dev)) { !real_dev->xfrmdev_ops->xdo_dev_state_add ||
spin_lock_bh(&bond->ipsec_lock); netif_is_bond_master(real_dev)) {
if (!list_empty(&bond->ipsec_list)) if (!list_empty(&bond->ipsec_list))
slave_warn(bond_dev, slave->dev, slave_warn(bond_dev, real_dev,
"%s: no slave xdo_dev_state_add\n", "%s: no slave xdo_dev_state_add\n",
__func__); __func__);
spin_unlock_bh(&bond->ipsec_lock);
goto out; goto out;
} }
spin_lock_bh(&bond->ipsec_lock);
list_for_each_entry(ipsec, &bond->ipsec_list, list) { list_for_each_entry(ipsec, &bond->ipsec_list, list) {
ipsec->xs->xso.real_dev = slave->dev; /* If new state is added before ipsec_lock acquired */
if (slave->dev->xfrmdev_ops->xdo_dev_state_add(ipsec->xs, NULL)) { if (ipsec->xs->xso.real_dev == real_dev)
slave_warn(bond_dev, slave->dev, "%s: failed to add SA\n", __func__); continue;
ipsec->xs->xso.real_dev = real_dev;
if (real_dev->xfrmdev_ops->xdo_dev_state_add(ipsec->xs, NULL)) {
slave_warn(bond_dev, real_dev, "%s: failed to add SA\n", __func__);
ipsec->xs->xso.real_dev = NULL; ipsec->xs->xso.real_dev = NULL;
} }
} }
spin_unlock_bh(&bond->ipsec_lock);
out: out:
rcu_read_unlock(); mutex_unlock(&bond->ipsec_lock);
} }
/** /**
...@@ -515,6 +523,8 @@ static void bond_ipsec_add_sa_all(struct bonding *bond) ...@@ -515,6 +523,8 @@ static void bond_ipsec_add_sa_all(struct bonding *bond)
static void bond_ipsec_del_sa(struct xfrm_state *xs) static void bond_ipsec_del_sa(struct xfrm_state *xs)
{ {
struct net_device *bond_dev = xs->xso.dev; struct net_device *bond_dev = xs->xso.dev;
struct net_device *real_dev;
netdevice_tracker tracker;
struct bond_ipsec *ipsec; struct bond_ipsec *ipsec;
struct bonding *bond; struct bonding *bond;
struct slave *slave; struct slave *slave;
...@@ -525,6 +535,9 @@ static void bond_ipsec_del_sa(struct xfrm_state *xs) ...@@ -525,6 +535,9 @@ static void bond_ipsec_del_sa(struct xfrm_state *xs)
rcu_read_lock(); rcu_read_lock();
bond = netdev_priv(bond_dev); bond = netdev_priv(bond_dev);
slave = rcu_dereference(bond->curr_active_slave); slave = rcu_dereference(bond->curr_active_slave);
real_dev = slave ? slave->dev : NULL;
netdev_hold(real_dev, &tracker, GFP_ATOMIC);
rcu_read_unlock();
if (!slave) if (!slave)
goto out; goto out;
...@@ -532,18 +545,19 @@ static void bond_ipsec_del_sa(struct xfrm_state *xs) ...@@ -532,18 +545,19 @@ static void bond_ipsec_del_sa(struct xfrm_state *xs)
if (!xs->xso.real_dev) if (!xs->xso.real_dev)
goto out; goto out;
WARN_ON(xs->xso.real_dev != slave->dev); WARN_ON(xs->xso.real_dev != real_dev);
if (!slave->dev->xfrmdev_ops || if (!real_dev->xfrmdev_ops ||
!slave->dev->xfrmdev_ops->xdo_dev_state_delete || !real_dev->xfrmdev_ops->xdo_dev_state_delete ||
netif_is_bond_master(slave->dev)) { netif_is_bond_master(real_dev)) {
slave_warn(bond_dev, slave->dev, "%s: no slave xdo_dev_state_delete\n", __func__); slave_warn(bond_dev, real_dev, "%s: no slave xdo_dev_state_delete\n", __func__);
goto out; goto out;
} }
slave->dev->xfrmdev_ops->xdo_dev_state_delete(xs); real_dev->xfrmdev_ops->xdo_dev_state_delete(xs);
out: out:
spin_lock_bh(&bond->ipsec_lock); netdev_put(real_dev, &tracker);
mutex_lock(&bond->ipsec_lock);
list_for_each_entry(ipsec, &bond->ipsec_list, list) { list_for_each_entry(ipsec, &bond->ipsec_list, list) {
if (ipsec->xs == xs) { if (ipsec->xs == xs) {
list_del(&ipsec->list); list_del(&ipsec->list);
...@@ -551,40 +565,72 @@ static void bond_ipsec_del_sa(struct xfrm_state *xs) ...@@ -551,40 +565,72 @@ static void bond_ipsec_del_sa(struct xfrm_state *xs)
break; break;
} }
} }
spin_unlock_bh(&bond->ipsec_lock); mutex_unlock(&bond->ipsec_lock);
rcu_read_unlock();
} }
static void bond_ipsec_del_sa_all(struct bonding *bond) static void bond_ipsec_del_sa_all(struct bonding *bond)
{ {
struct net_device *bond_dev = bond->dev; struct net_device *bond_dev = bond->dev;
struct net_device *real_dev;
struct bond_ipsec *ipsec; struct bond_ipsec *ipsec;
struct slave *slave; struct slave *slave;
rcu_read_lock(); slave = rtnl_dereference(bond->curr_active_slave);
slave = rcu_dereference(bond->curr_active_slave); real_dev = slave ? slave->dev : NULL;
if (!slave) { if (!real_dev)
rcu_read_unlock();
return; return;
}
spin_lock_bh(&bond->ipsec_lock); mutex_lock(&bond->ipsec_lock);
list_for_each_entry(ipsec, &bond->ipsec_list, list) { list_for_each_entry(ipsec, &bond->ipsec_list, list) {
if (!ipsec->xs->xso.real_dev) if (!ipsec->xs->xso.real_dev)
continue; continue;
if (!slave->dev->xfrmdev_ops || if (!real_dev->xfrmdev_ops ||
!slave->dev->xfrmdev_ops->xdo_dev_state_delete || !real_dev->xfrmdev_ops->xdo_dev_state_delete ||
netif_is_bond_master(slave->dev)) { netif_is_bond_master(real_dev)) {
slave_warn(bond_dev, slave->dev, slave_warn(bond_dev, real_dev,
"%s: no slave xdo_dev_state_delete\n", "%s: no slave xdo_dev_state_delete\n",
__func__); __func__);
} else { } else {
slave->dev->xfrmdev_ops->xdo_dev_state_delete(ipsec->xs); real_dev->xfrmdev_ops->xdo_dev_state_delete(ipsec->xs);
if (real_dev->xfrmdev_ops->xdo_dev_state_free)
real_dev->xfrmdev_ops->xdo_dev_state_free(ipsec->xs);
} }
} }
spin_unlock_bh(&bond->ipsec_lock); mutex_unlock(&bond->ipsec_lock);
}
static void bond_ipsec_free_sa(struct xfrm_state *xs)
{
struct net_device *bond_dev = xs->xso.dev;
struct net_device *real_dev;
netdevice_tracker tracker;
struct bonding *bond;
struct slave *slave;
if (!bond_dev)
return;
rcu_read_lock();
bond = netdev_priv(bond_dev);
slave = rcu_dereference(bond->curr_active_slave);
real_dev = slave ? slave->dev : NULL;
netdev_hold(real_dev, &tracker, GFP_ATOMIC);
rcu_read_unlock(); rcu_read_unlock();
if (!slave)
goto out;
if (!xs->xso.real_dev)
goto out;
WARN_ON(xs->xso.real_dev != real_dev);
if (real_dev && real_dev->xfrmdev_ops &&
real_dev->xfrmdev_ops->xdo_dev_state_free)
real_dev->xfrmdev_ops->xdo_dev_state_free(xs);
out:
netdev_put(real_dev, &tracker);
} }
/** /**
...@@ -627,6 +673,7 @@ static bool bond_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *xs) ...@@ -627,6 +673,7 @@ static bool bond_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *xs)
static const struct xfrmdev_ops bond_xfrmdev_ops = { static const struct xfrmdev_ops bond_xfrmdev_ops = {
.xdo_dev_state_add = bond_ipsec_add_sa, .xdo_dev_state_add = bond_ipsec_add_sa,
.xdo_dev_state_delete = bond_ipsec_del_sa, .xdo_dev_state_delete = bond_ipsec_del_sa,
.xdo_dev_state_free = bond_ipsec_free_sa,
.xdo_dev_offload_ok = bond_ipsec_offload_ok, .xdo_dev_offload_ok = bond_ipsec_offload_ok,
}; };
#endif /* CONFIG_XFRM_OFFLOAD */ #endif /* CONFIG_XFRM_OFFLOAD */
...@@ -5877,7 +5924,7 @@ void bond_setup(struct net_device *bond_dev) ...@@ -5877,7 +5924,7 @@ void bond_setup(struct net_device *bond_dev)
/* set up xfrm device ops (only supported in active-backup right now) */ /* set up xfrm device ops (only supported in active-backup right now) */
bond_dev->xfrmdev_ops = &bond_xfrmdev_ops; bond_dev->xfrmdev_ops = &bond_xfrmdev_ops;
INIT_LIST_HEAD(&bond->ipsec_list); INIT_LIST_HEAD(&bond->ipsec_list);
spin_lock_init(&bond->ipsec_lock); mutex_init(&bond->ipsec_lock);
#endif /* CONFIG_XFRM_OFFLOAD */ #endif /* CONFIG_XFRM_OFFLOAD */
/* don't acquire bond device's netif_tx_lock when transmitting */ /* don't acquire bond device's netif_tx_lock when transmitting */
...@@ -5926,6 +5973,10 @@ static void bond_uninit(struct net_device *bond_dev) ...@@ -5926,6 +5973,10 @@ static void bond_uninit(struct net_device *bond_dev)
__bond_release_one(bond_dev, slave->dev, true, true); __bond_release_one(bond_dev, slave->dev, true, true);
netdev_info(bond_dev, "Released all slaves\n"); netdev_info(bond_dev, "Released all slaves\n");
#ifdef CONFIG_XFRM_OFFLOAD
mutex_destroy(&bond->ipsec_lock);
#endif /* CONFIG_XFRM_OFFLOAD */
bond_set_slave_arr(bond, NULL, NULL); bond_set_slave_arr(bond, NULL, NULL);
list_del_rcu(&bond->bond_list); list_del_rcu(&bond->bond_list);
......
include/net/bonding.h
View file @ 2fecbf75
...@@ -260,7 +260,7 @@ struct bonding { ...@@ -260,7 +260,7 @@ struct bonding {
#ifdef CONFIG_XFRM_OFFLOAD #ifdef CONFIG_XFRM_OFFLOAD
struct list_head ipsec_list; struct list_head ipsec_list;
/* protecting ipsec_list */ /* protecting ipsec_list */
spinlock_t ipsec_lock; struct mutex ipsec_lock;
#endif /* CONFIG_XFRM_OFFLOAD */ #endif /* CONFIG_XFRM_OFFLOAD */
struct bpf_prog *xdp_prog; struct bpf_prog *xdp_prog;
}; };
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7