Commit 2fecbf75 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'fixes-for-ipsec-over-bonding' 

Jianbo Liu says:

====================
Fixes for IPsec over bonding

This patchset provides bug fixes for IPsec over bonding driver.

It adds the missing xdo_dev_state_free API, and fixes "scheduling while
atomic" by using mutex lock instead.

Series generated against:
commit c07ff859 ("netem: fix return value if duplicate enqueue fails")
====================

Link: https://patch.msgid.link/20240823031056.110999-1-jianbol@nvidia.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 65a3cce4 2aeeef90

drivers/net/bonding/bond_main.c

+105 −54
Original line number Diff line number Diff line
@@ -427,6 +427,8 @@ static int bond_ipsec_add_sa(struct xfrm_state *xs, 
			     struct netlink_ext_ack *extack)

{

	struct net_device *bond_dev = xs->xso.dev;

	struct net_device *real_dev;

	netdevice_tracker tracker;

	struct bond_ipsec *ipsec;

	struct bonding *bond;

	struct slave *slave;
@@ -438,74 +440,80 @@ static int bond_ipsec_add_sa(struct xfrm_state *xs, 
	rcu_read_lock();

	bond = netdev_priv(bond_dev);

	slave = rcu_dereference(bond->curr_active_slave);

	if (!slave) {

	real_dev = slave ? slave->dev : NULL;

	netdev_hold(real_dev, &tracker, GFP_ATOMIC);

	rcu_read_unlock();

		return -ENODEV;

	if (!real_dev) {

		err = -ENODEV;

		goto out;

	}



	if (!slave->dev->xfrmdev_ops ||

	    !slave->dev->xfrmdev_ops->xdo_dev_state_add ||

	    netif_is_bond_master(slave->dev)) {

	if (!real_dev->xfrmdev_ops ||

	    !real_dev->xfrmdev_ops->xdo_dev_state_add ||

	    netif_is_bond_master(real_dev)) {

		NL_SET_ERR_MSG_MOD(extack, "Slave does not support ipsec offload");

		rcu_read_unlock();

		return -EINVAL;

		err = -EINVAL;

		goto out;

	}



	ipsec = kmalloc(sizeof(*ipsec), GFP_ATOMIC);

	ipsec = kmalloc(sizeof(*ipsec), GFP_KERNEL);

	if (!ipsec) {

		rcu_read_unlock();

		return -ENOMEM;

		err = -ENOMEM;

		goto out;

	}

	xs->xso.real_dev = slave->dev;



	err = slave->dev->xfrmdev_ops->xdo_dev_state_add(xs, extack);

	xs->xso.real_dev = real_dev;

	err = real_dev->xfrmdev_ops->xdo_dev_state_add(xs, extack);

	if (!err) {

		ipsec->xs = xs;

		INIT_LIST_HEAD(&ipsec->list);

		spin_lock_bh(&bond->ipsec_lock);

		mutex_lock(&bond->ipsec_lock);

		list_add(&ipsec->list, &bond->ipsec_list);

		spin_unlock_bh(&bond->ipsec_lock);

		mutex_unlock(&bond->ipsec_lock);

	} else {

		kfree(ipsec);

	}

	rcu_read_unlock();

out:

	netdev_put(real_dev, &tracker);

	return err;

}



static void bond_ipsec_add_sa_all(struct bonding *bond)

{

	struct net_device *bond_dev = bond->dev;

	struct net_device *real_dev;

	struct bond_ipsec *ipsec;

	struct slave *slave;



	rcu_read_lock();

	slave = rcu_dereference(bond->curr_active_slave);

	if (!slave)

		goto out;

	slave = rtnl_dereference(bond->curr_active_slave);

	real_dev = slave ? slave->dev : NULL;

	if (!real_dev)

		return;



	if (!slave->dev->xfrmdev_ops ||

	    !slave->dev->xfrmdev_ops->xdo_dev_state_add ||

	    netif_is_bond_master(slave->dev)) {

		spin_lock_bh(&bond->ipsec_lock);

	mutex_lock(&bond->ipsec_lock);

	if (!real_dev->xfrmdev_ops ||

	    !real_dev->xfrmdev_ops->xdo_dev_state_add ||

	    netif_is_bond_master(real_dev)) {

		if (!list_empty(&bond->ipsec_list))

			slave_warn(bond_dev, slave->dev,

			slave_warn(bond_dev, real_dev,

				   "%s: no slave xdo_dev_state_add\n",

				   __func__);

		spin_unlock_bh(&bond->ipsec_lock);

		goto out;

	}



	spin_lock_bh(&bond->ipsec_lock);

	list_for_each_entry(ipsec, &bond->ipsec_list, list) {

		ipsec->xs->xso.real_dev = slave->dev;

		if (slave->dev->xfrmdev_ops->xdo_dev_state_add(ipsec->xs, NULL)) {

			slave_warn(bond_dev, slave->dev, "%s: failed to add SA\n", __func__);

		/* If new state is added before ipsec_lock acquired */

		if (ipsec->xs->xso.real_dev == real_dev)

			continue;



		ipsec->xs->xso.real_dev = real_dev;

		if (real_dev->xfrmdev_ops->xdo_dev_state_add(ipsec->xs, NULL)) {

			slave_warn(bond_dev, real_dev, "%s: failed to add SA\n", __func__);

			ipsec->xs->xso.real_dev = NULL;

		}

	}

	spin_unlock_bh(&bond->ipsec_lock);

out:

	rcu_read_unlock();

	mutex_unlock(&bond->ipsec_lock);

}



/**
@@ -515,6 +523,8 @@ static void bond_ipsec_add_sa_all(struct bonding *bond) 
static void bond_ipsec_del_sa(struct xfrm_state *xs)

{

	struct net_device *bond_dev = xs->xso.dev;

	struct net_device *real_dev;

	netdevice_tracker tracker;

	struct bond_ipsec *ipsec;

	struct bonding *bond;

	struct slave *slave;
@@ -525,6 +535,9 @@ static void bond_ipsec_del_sa(struct xfrm_state *xs) 
	rcu_read_lock();

	bond = netdev_priv(bond_dev);

	slave = rcu_dereference(bond->curr_active_slave);

	real_dev = slave ? slave->dev : NULL;

	netdev_hold(real_dev, &tracker, GFP_ATOMIC);

	rcu_read_unlock();



	if (!slave)

		goto out;
@@ -532,18 +545,19 @@ static void bond_ipsec_del_sa(struct xfrm_state *xs) 
	if (!xs->xso.real_dev)

		goto out;



	WARN_ON(xs->xso.real_dev != slave->dev);

	WARN_ON(xs->xso.real_dev != real_dev);



	if (!slave->dev->xfrmdev_ops ||

	    !slave->dev->xfrmdev_ops->xdo_dev_state_delete ||

	    netif_is_bond_master(slave->dev)) {

		slave_warn(bond_dev, slave->dev, "%s: no slave xdo_dev_state_delete\n", __func__);

	if (!real_dev->xfrmdev_ops ||

	    !real_dev->xfrmdev_ops->xdo_dev_state_delete ||

	    netif_is_bond_master(real_dev)) {

		slave_warn(bond_dev, real_dev, "%s: no slave xdo_dev_state_delete\n", __func__);

		goto out;

	}



	slave->dev->xfrmdev_ops->xdo_dev_state_delete(xs);

	real_dev->xfrmdev_ops->xdo_dev_state_delete(xs);

out:

	spin_lock_bh(&bond->ipsec_lock);

	netdev_put(real_dev, &tracker);

	mutex_lock(&bond->ipsec_lock);

	list_for_each_entry(ipsec, &bond->ipsec_list, list) {

		if (ipsec->xs == xs) {

			list_del(&ipsec->list);
@@ -551,40 +565,72 @@ static void bond_ipsec_del_sa(struct xfrm_state *xs) 
			break;

		}

	}

	spin_unlock_bh(&bond->ipsec_lock);

	rcu_read_unlock();

	mutex_unlock(&bond->ipsec_lock);

}



static void bond_ipsec_del_sa_all(struct bonding *bond)

{

	struct net_device *bond_dev = bond->dev;

	struct net_device *real_dev;

	struct bond_ipsec *ipsec;

	struct slave *slave;



	rcu_read_lock();

	slave = rcu_dereference(bond->curr_active_slave);

	if (!slave) {

		rcu_read_unlock();

	slave = rtnl_dereference(bond->curr_active_slave);

	real_dev = slave ? slave->dev : NULL;

	if (!real_dev)

		return;

	}



	spin_lock_bh(&bond->ipsec_lock);

	mutex_lock(&bond->ipsec_lock);

	list_for_each_entry(ipsec, &bond->ipsec_list, list) {

		if (!ipsec->xs->xso.real_dev)

			continue;



		if (!slave->dev->xfrmdev_ops ||

		    !slave->dev->xfrmdev_ops->xdo_dev_state_delete ||

		    netif_is_bond_master(slave->dev)) {

			slave_warn(bond_dev, slave->dev,

		if (!real_dev->xfrmdev_ops ||

		    !real_dev->xfrmdev_ops->xdo_dev_state_delete ||

		    netif_is_bond_master(real_dev)) {

			slave_warn(bond_dev, real_dev,

				   "%s: no slave xdo_dev_state_delete\n",

				   __func__);

		} else {

			slave->dev->xfrmdev_ops->xdo_dev_state_delete(ipsec->xs);

			real_dev->xfrmdev_ops->xdo_dev_state_delete(ipsec->xs);

			if (real_dev->xfrmdev_ops->xdo_dev_state_free)

				real_dev->xfrmdev_ops->xdo_dev_state_free(ipsec->xs);

		}

	}

	mutex_unlock(&bond->ipsec_lock);

}

	spin_unlock_bh(&bond->ipsec_lock);



static void bond_ipsec_free_sa(struct xfrm_state *xs)

{

	struct net_device *bond_dev = xs->xso.dev;

	struct net_device *real_dev;

	netdevice_tracker tracker;

	struct bonding *bond;

	struct slave *slave;



	if (!bond_dev)

		return;



	rcu_read_lock();

	bond = netdev_priv(bond_dev);

	slave = rcu_dereference(bond->curr_active_slave);

	real_dev = slave ? slave->dev : NULL;

	netdev_hold(real_dev, &tracker, GFP_ATOMIC);

	rcu_read_unlock();



	if (!slave)

		goto out;



	if (!xs->xso.real_dev)

		goto out;



	WARN_ON(xs->xso.real_dev != real_dev);



	if (real_dev && real_dev->xfrmdev_ops &&

	    real_dev->xfrmdev_ops->xdo_dev_state_free)

		real_dev->xfrmdev_ops->xdo_dev_state_free(xs);

out:

	netdev_put(real_dev, &tracker);

}



/**
@@ -627,6 +673,7 @@ static bool bond_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *xs) 
static const struct xfrmdev_ops bond_xfrmdev_ops = {

	.xdo_dev_state_add = bond_ipsec_add_sa,

	.xdo_dev_state_delete = bond_ipsec_del_sa,

	.xdo_dev_state_free = bond_ipsec_free_sa,

	.xdo_dev_offload_ok = bond_ipsec_offload_ok,

};

#endif /* CONFIG_XFRM_OFFLOAD */
@@ -5877,7 +5924,7 @@ void bond_setup(struct net_device *bond_dev) 
	/* set up xfrm device ops (only supported in active-backup right now) */

	bond_dev->xfrmdev_ops = &bond_xfrmdev_ops;

	INIT_LIST_HEAD(&bond->ipsec_list);

	spin_lock_init(&bond->ipsec_lock);

	mutex_init(&bond->ipsec_lock);

#endif /* CONFIG_XFRM_OFFLOAD */



	/* don't acquire bond device's netif_tx_lock when transmitting */
@@ -5926,6 +5973,10 @@ static void bond_uninit(struct net_device *bond_dev) 
		__bond_release_one(bond_dev, slave->dev, true, true);

	netdev_info(bond_dev, "Released all slaves\n");



#ifdef CONFIG_XFRM_OFFLOAD

	mutex_destroy(&bond->ipsec_lock);

#endif /* CONFIG_XFRM_OFFLOAD */



	bond_set_slave_arr(bond, NULL, NULL);



	list_del_rcu(&bond->bond_list);

include/net/bonding.h

+1 −1
Original line number Diff line number Diff line
@@ -260,7 +260,7 @@ struct bonding { 
#ifdef CONFIG_XFRM_OFFLOAD

	struct list_head ipsec_list;

	/* protecting ipsec_list */

	spinlock_t ipsec_lock;

	struct mutex ipsec_lock;

#endif /* CONFIG_XFRM_OFFLOAD */

	struct bpf_prog *xdp_prog;

};