Commit 28712d6e authored by Steffen Klassert's avatar Steffen Klassert
Browse files

Merge branch 'ipsec: fix splat due to ipcomp fallback tunnel' 



Sabrina Dubroca says:

====================
IPcomp tunnel states have an associated fallback tunnel, a keep a
reference on the corresponding xfrm_state, to allow deleting that
extra state when it's not needed anymore. These states cause issues
during netns deletion.

Commit f75a2804 ("xfrm: destroy xfrm_state synchronously on net
exit path") tried to address these problems but doesn't fully solve
them, and slowed down netns deletion by adding one synchronize_rcu per
deleted state.

The first patch solves the problem by moving the fallback state
deletion earlier (when we delete the user state, rather than at
destruction), then we can revert the previous fix.
====================

Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parents a90b2a1a 2a198bbe

include/net/xfrm.h

+3 −10
Original line number Diff line number Diff line
@@ -441,7 +441,6 @@ int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo); 
int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo);



void xfrm_flush_gc(void);

void xfrm_state_delete_tunnel(struct xfrm_state *x);



struct xfrm_type {

	struct module		*owner;
@@ -916,7 +915,7 @@ static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols) 
		xfrm_pol_put(pols[i]);

}



void __xfrm_state_destroy(struct xfrm_state *, bool);

void __xfrm_state_destroy(struct xfrm_state *);



static inline void __xfrm_state_put(struct xfrm_state *x)

{
@@ -926,13 +925,7 @@ static inline void __xfrm_state_put(struct xfrm_state *x) 
static inline void xfrm_state_put(struct xfrm_state *x)

{

	if (refcount_dec_and_test(&x->refcnt))

		__xfrm_state_destroy(x, false);

}



static inline void xfrm_state_put_sync(struct xfrm_state *x)

{

	if (refcount_dec_and_test(&x->refcnt))

		__xfrm_state_destroy(x, true);

		__xfrm_state_destroy(x);

}



static inline void xfrm_state_hold(struct xfrm_state *x)
@@ -1770,7 +1763,7 @@ struct xfrmk_spdinfo { 


struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq, u32 pcpu_num);

int xfrm_state_delete(struct xfrm_state *x);

int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync);

int xfrm_state_flush(struct net *net, u8 proto, bool task_valid);

int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid);

int xfrm_dev_policy_flush(struct net *net, struct net_device *dev,

			  bool task_valid);

net/ipv4/ipcomp.c

+2 −0
Original line number Diff line number Diff line
@@ -54,6 +54,7 @@ static int ipcomp4_err(struct sk_buff *skb, u32 info) 
}



/* We always hold one tunnel user reference to indicate a tunnel */

static struct lock_class_key xfrm_state_lock_key;

static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x)

{

	struct net *net = xs_net(x);
@@ -62,6 +63,7 @@ static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x) 
	t = xfrm_state_alloc(net);

	if (!t)

		goto out;

	lockdep_set_class(&t->lock, &xfrm_state_lock_key);



	t->id.proto = IPPROTO_IPIP;

	t->id.spi = x->props.saddr.a4;

net/ipv6/ipcomp6.c

+2 −0
Original line number Diff line number Diff line
@@ -71,6 +71,7 @@ static int ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, 
	return 0;

}



static struct lock_class_key xfrm_state_lock_key;

static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x)

{

	struct net *net = xs_net(x);
@@ -79,6 +80,7 @@ static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x) 
	t = xfrm_state_alloc(net);

	if (!t)

		goto out;

	lockdep_set_class(&t->lock, &xfrm_state_lock_key);



	t->id.proto = IPPROTO_IPV6;

	t->id.spi = xfrm6_tunnel_alloc_spi(net, (xfrm_address_t *)&x->props.saddr);

net/ipv6/xfrm6_tunnel.c

+1 −1
Original line number Diff line number Diff line
@@ -334,8 +334,8 @@ static void __net_exit xfrm6_tunnel_net_exit(struct net *net) 
	struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);

	unsigned int i;



	xfrm_state_flush(net, IPSEC_PROTO_ANY, false);

	xfrm_flush_gc();

	xfrm_state_flush(net, 0, false, true);



	for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++)

		WARN_ON_ONCE(!hlist_empty(&xfrm6_tn->spi_byaddr[i]));

net/key/af_key.c

+1 −1
Original line number Diff line number Diff line
@@ -1766,7 +1766,7 @@ static int pfkey_flush(struct sock *sk, struct sk_buff *skb, const struct sadb_m 
	if (proto == 0)

		return -EINVAL;



	err = xfrm_state_flush(net, proto, true, false);

	err = xfrm_state_flush(net, proto, true);

	err2 = unicast_flush_resp(sk, hdr);

	if (err || err2) {

		if (err == -ESRCH) /* empty table - go quietly */