Commit 85905414 authored by Jakub Kicinski's avatar Jakub Kicinski Committed by David S. Miller
Browse files

net: tls: handle backlogging of crypto requests 



Since we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our
requests to the crypto API, crypto_aead_{encrypt,decrypt} can return
 -EBUSY instead of -EINPROGRESS in valid situations. For example, when
the cryptd queue for AESNI is full (easy to trigger with an
artificially low cryptd.cryptd_max_cpu_qlen), requests will be enqueued
to the backlog but still processed. In that case, the async callback
will also be called twice: first with err == -EINPROGRESS, which it
seems we can just ignore, then with err == 0.

Compared to Sabrina's original patch this version uses the new
tls_*crypt_async_wait() helpers and converts the EBUSY to
EINPROGRESS to avoid having to modify all the error handling
paths. The handling is identical.

Fixes: a54667f6 ("tls: Add support for encryption using async offload accelerator")
Fixes: 94524d8f ("net/tls: Add support for async decryption of tls records")
Co-developed-by: default avatarSabrina Dubroca <sd@queasysnail.net>
Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
Link: https://lore.kernel.org/netdev/9681d1febfec295449a62300938ed2ae66983f28.1694018970.git.sd@queasysnail.net/


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e01e3934

net/tls/tls_sw.c

+22 −0
Original line number Diff line number Diff line
@@ -196,6 +196,17 @@ static void tls_decrypt_done(void *data, int err) 
	struct sock *sk;

	int aead_size;



	/* If requests get too backlogged crypto API returns -EBUSY and calls

	 * ->complete(-EINPROGRESS) immediately followed by ->complete(0)

	 * to make waiting for backlog to flush with crypto_wait_req() easier.

	 * First wait converts -EBUSY -> -EINPROGRESS, and the second one

	 * -EINPROGRESS -> 0.

	 * We have a single struct crypto_async_request per direction, this

	 * scheme doesn't help us, so just ignore the first ->complete().

	 */

	if (err == -EINPROGRESS)

		return;



	aead_size = sizeof(*aead_req) + crypto_aead_reqsize(aead);

	aead_size = ALIGN(aead_size, __alignof__(*dctx));

	dctx = (void *)((u8 *)aead_req + aead_size);
@@ -269,6 +280,10 @@ static int tls_do_decryption(struct sock *sk, 
	}



	ret = crypto_aead_decrypt(aead_req);

	if (ret == -EBUSY) {

		ret = tls_decrypt_async_wait(ctx);

		ret = ret ?: -EINPROGRESS;

	}

	if (ret == -EINPROGRESS) {

		if (darg->async)

			return 0;
@@ -449,6 +464,9 @@ static void tls_encrypt_done(void *data, int err) 
	struct sk_msg *msg_en;

	struct sock *sk;



	if (err == -EINPROGRESS) /* see the comment in tls_decrypt_done() */

		return;



	msg_en = &rec->msg_encrypted;



	sk = rec->sk;
@@ -553,6 +571,10 @@ static int tls_do_encryption(struct sock *sk, 
	atomic_inc(&ctx->encrypt_pending);



	rc = crypto_aead_encrypt(aead_req);

	if (rc == -EBUSY) {

		rc = tls_encrypt_async_wait(ctx);

		rc = rc ?: -EINPROGRESS;

	}

	if (!rc || rc != -EINPROGRESS) {

		atomic_dec(&ctx->encrypt_pending);

		sge->offset -= prot->prepend_size;