net/tls: Protect from calling tls_dev_del for TLS RX twice

[ Upstream commit 025cc2fb6a4e84e9a0552c0017dcd1c24b7ac7da ]

tls_device_offload_cleanup_rx doesn't clear tls_ctx->netdev after
calling tls_dev_del if TLX TX offload is also enabled. Clearing
tls_ctx->netdev gets postponed until tls_device_gc_task. It leaves a
time frame when tls_device_down may get called and call tls_dev_del for
RX one extra time, confusing the driver, which may lead to a crash.

This patch corrects this racy behavior by adding a flag to prevent
tls_device_down from calling tls_dev_del the second time.

Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure")
Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Link: https://lore.kernel.org/r/20201125221810.69870-1-saeedm@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/include/net/tls.h b/include/net/tls.h
index 0a065bdffa395a717aad5ed2293210c149f6897a..697df45c0bceee3864ef441280a83dbb69dfe3ef 100644 (file)
--- a/include/net/tls.h
+++ b/include/net/tls.h
@@ -221,6 +221,12 @@ enum tls_context_flags {
         * to be atomic.
         */
        TLS_TX_SYNC_SCHED = 1,
+       /* tls_dev_del was called for the RX side, device state was released,
+        * but tls_ctx->netdev might still be kept, because TX-side driver
+        * resources might not be released yet. Used to prevent the second
+        * tls_dev_del call in tls_device_down if it happens simultaneously.
+        */
+       TLS_RX_DEV_CLOSED = 2,
 };
 
 struct cipher_context {

diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
index 933a3187d3bf2301e8837e8a8d99aff8d9cf43b2..0f034c3bc37d7416371e74d82fccf6f50679d70f 100644 (file)
--- a/net/tls/tls_device.c
+++ b/net/tls/tls_device.c
@@ -1163,6 +1163,8 @@ void tls_device_offload_cleanup_rx(struct sock *sk)
        if (tls_ctx->tx_conf != TLS_HW) {
                dev_put(netdev);
                tls_ctx->netdev = NULL;
+       } else {
+               set_bit(TLS_RX_DEV_CLOSED, &tls_ctx->flags);
        }
 out:
        up_read(&device_offload_lock);
@@ -1192,7 +1194,8 @@ static int tls_device_down(struct net_device *netdev)
                if (ctx->tx_conf == TLS_HW)
                        netdev->tlsdev_ops->tls_dev_del(netdev, ctx,
                                                        TLS_OFFLOAD_CTX_DIR_TX);
-               if (ctx->rx_conf == TLS_HW)
+               if (ctx->rx_conf == TLS_HW &&
+                   !test_bit(TLS_RX_DEV_CLOSED, &ctx->flags))
                        netdev->tlsdev_ops->tls_dev_del(netdev, ctx,
                                                        TLS_OFFLOAD_CTX_DIR_RX);
                WRITE_ONCE(ctx->netdev, NULL);