net/tls: Protect from calling tls_dev_del for TLS RX twice (025cc2fb) · Commits · 戴 / test

tls_device_offload_cleanup_rx doesn't clear tls_ctx->netdev after calling tls_dev_del if TLX TX offload is also enabled. Clearing tls_ctx->netdev gets postponed until tls_device_gc_task. It leaves a time frame when tls_device_down may get called and call tls_dev_del for RX one extra time, confusing the driver, which may lead to a crash. This patch corrects this racy behavior by adding a flag to prevent tls_device_down from calling tls_dev_del the second time. Fixes: ("net/tls: Add generic NIC offload infrastructure") Signed-off-by:

Maxim Mikityanskiy <maximmi@mellanox.com> Signed-off-by:

Saeed Mahameed <saeedm@nvidia.com> Link: https://lore.kernel.org/r/20201125221810.69870-1-saeedm@nvidia.com Signed-off-by:

Jakub Kicinski <kuba@kernel.org>

include/net/tls.h

+6 −0

Original line number	Diff line number	Diff line
		@@ -199,6 +199,12 @@ enum tls_context_flags {
		* to be atomic.
		*/
		TLS_TX_SYNC_SCHED = 1,
		/* tls_dev_del was called for the RX side, device state was released,
		* but tls_ctx->netdev might still be kept, because TX-side driver
		* resources might not be released yet. Used to prevent the second
		* tls_dev_del call in tls_device_down if it happens simultaneously.
		*/
		TLS_RX_DEV_CLOSED = 2,
		};

		struct cipher_context {

net/tls/tls_device.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -1262,6 +1262,8 @@ void tls_device_offload_cleanup_rx(struct sock *sk)
		if (tls_ctx->tx_conf != TLS_HW) {
		dev_put(netdev);
		tls_ctx->netdev = NULL;
		} else {
		set_bit(TLS_RX_DEV_CLOSED, &tls_ctx->flags);
		}
		out:
		up_read(&device_offload_lock);
		@@ -1291,7 +1293,8 @@ static int tls_device_down(struct net_device *netdev)
		if (ctx->tx_conf == TLS_HW)
		netdev->tlsdev_ops->tls_dev_del(netdev, ctx,
		TLS_OFFLOAD_CTX_DIR_TX);
		if (ctx->rx_conf == TLS_HW)
		if (ctx->rx_conf == TLS_HW &&
		!test_bit(TLS_RX_DEV_CLOSED, &ctx->flags))
		netdev->tlsdev_ops->tls_dev_del(netdev, ctx,
		TLS_OFFLOAD_CTX_DIR_RX);
		WRITE_ONCE(ctx->netdev, NULL);

Admin message