Changes in tls_device_fallback.c

6be051ce - net/tls: use the new scatterwalk functions

Wed, 19 Feb 2025 18:23:38 +0000

net/tls: use the new scatterwalk functionsReplace calls to the deprecated function scatterwalk_copychunks() withmemcpy_from_scatterwalk(), memcpy_to_scatterwalk(), orscatterwalk_skip() as appropriate. The new functions generally behavemore as expected and eliminate the need to call scatterwalk_done() orscatterwalk_pagedone().However, the new functions intentionally do not advance to the next sgentry right away, which would have broken chain_to_walk() which isaccessing the fields of struct scatter_walk directly. To avoid this,replace chain_to_walk() with scatterwalk_get_sglist() which supports theneeded functionality.Cc: Boris Pismenny Cc: Jakub Kicinski Cc: John Fastabend Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu List of files: /linux-6.15/net/tls/tls_device_fallback.c

173e7622 - Revert "net: mirror skb frag ref/unref helpers"

Thu, 02 May 2024 17:54:22 +0000

Revert "net: mirror skb frag ref/unref helpers"This reverts commit a580ea994fd37f4105028f5a85c38ff6508a2b25.This revert is to resolve Dragos's report of page_pool leak here:https://lore.kernel.org/lkml/20240424165646.1625690-2-dtatulea@nvidia.com/The reverted patch interacts very badly with commit 2cc3aeb5eccc ("skbuff:Fix a potential race while recycling page_pool packets"). The revertedcommit hopes that the pp_recycle + is_pp_page variables do not changebetween the skb_frag_ref and skb_frag_unref operation. If such a changeoccurs, the skb_frag_ref/unref will not operate on the same reference type.In the case of Dragos's report, the grabbed ref was a pp ref, but the unrefwas a page ref, because the pp_recycle setting on the skb was changed.Attempting to fix this issue on the fly is risky. Lets revert and I hopeto reland this with better understanding and testing to ensure we don'tregress some edge case while streamlining skb reffing.Fixes: a580ea994fd3 ("net: mirror skb frag ref/unref helpers")Reported-by: Dragos Tatulea Signed-off-by: Mina Almasry Link: https://lore.kernel.org/r/20240502175423.2456544-1-almasrymina@google.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/tls/tls_device_fallback.c

a580ea99 - net: mirror skb frag ref/unref helpers

Wed, 10 Apr 2024 19:05:02 +0000

net: mirror skb frag ref/unref helpersRefactor some of the skb frag ref/unref helpers for improved clarity.Implement napi_pp_get_page() to be the mirror counterpart ofnapi_pp_put_page().Implement skb_page_ref() to be the mirror of skb_page_unref().Improve __skb_frag_ref() to become a mirror counterpart of__skb_frag_unref(). Previously unref could handle pp & non-pp pages,while the ref could only handle non-pp pages. Now both the ref & unrefhelpers can correctly handle both pp & non-pp pages.Now that __skb_frag_ref() can handle both pp & non-pp pages, removeskb_pp_frag_ref(), and use __skb_frag_ref() instead. This lets usremove pp specific handling from skb_try_coalesce.Additionally, since __skb_frag_ref() can now handle both pp & non-pppages, a latent issue in skb_shift() should now be fixed. Previouslythis function would do a non-pp ref & pp unref on potential pp frags(fragfrom). After this patch, skb_shift() should correctly do a ppref/unref on pp frags.Signed-off-by: Mina Almasry Reviewed-by: Dragos Tatulea Reviewed-by: Jacob Keller Link: https://lore.kernel.org/r/20240410190505.1225848-3-almasrymina@google.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/tls/tls_device_fallback.c

f6d827b1 - net: move skb ref helpers to new header

Wed, 10 Apr 2024 19:05:01 +0000

net: move skb ref helpers to new headerAdd a new header, linux/skbuff_ref.h, which contains all the skb_*_ref()helpers. Many of the consumers of skbuff.h do not actually use any ofthe skb ref helpers, and we can speed up compilation a bit by minimizingthis header file.Additionally in the later patch in the series we add page_pool supportto skb_frag_ref(), which requires some page_pool dependencies. We cannow add these dependencies to skbuff_ref.h instead of a very ubiquitousskbuff.hSigned-off-by: Mina Almasry Link: https://lore.kernel.org/r/20240410190505.1225848-2-almasrymina@google.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/tls/tls_device_fallback.c

bee6b7b3 - tls: rename MAX_IV_SIZE to TLS_MAX_IV_SIZE

Mon, 09 Oct 2023 20:50:44 +0000

tls: rename MAX_IV_SIZE to TLS_MAX_IV_SIZEIt's defined in include/net/tls.h, avoid using an overly generic name.Signed-off-by: Sabrina Dubroca Signed-off-by: David S. Miller List of files: /linux-6.15/net/tls/tls_device_fallback.c

8f1d532b - tls: drop unnecessary cipher_type checks in tls offload

Mon, 09 Oct 2023 20:50:42 +0000

tls: drop unnecessary cipher_type checks in tls offloadWe should never reach tls_device_reencrypt, tls_enc_record, ortls_enc_skb with a cipher_type that can't be offloaded. Replace thosechecks with a DEBUG_NET_WARN_ON_ONCE, and use cipher_desc instead ofhard-coding offloadable cipher types.Signed-off-by: Sabrina Dubroca Signed-off-by: David S. Miller List of files: /linux-6.15/net/tls/tls_device_fallback.c

3bab3ee0 - tls: get salt using crypto_info_salt in tls_enc_skb

Mon, 09 Oct 2023 20:50:41 +0000

tls: get salt using crypto_info_salt in tls_enc_skbI skipped this conversion in my previous series.Signed-off-by: Sabrina Dubroca Signed-off-by: David S. Miller List of files: /linux-6.15/net/tls/tls_device_fallback.c

e907277a - tls: expand use of tls_cipher_desc in tls_sw_fallback_init

Fri, 25 Aug 2023 21:35:17 +0000

tls: expand use of tls_cipher_desc in tls_sw_fallback_inittls_sw_fallback_init already gets the key and tag size fromtls_cipher_desc. We can now also check that the cipher type is valid,and stop hard-coding the algorithm name passed to crypto_alloc_aead.Signed-off-by: Sabrina Dubroca Link: https://lore.kernel.org/r/c8c94b8fcafbfb558e09589c1f1ad48dbdf92f76.1692977948.git.sd@queasysnail.netSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/tls/tls_device_fallback.c

d2322cf5 - tls: allocate the fallback aead after checking that the cipher is valid

Fri, 25 Aug 2023 21:35:16 +0000

tls: allocate the fallback aead after checking that the cipher is validNo need to allocate the aead if we're going to fail afterwards.Signed-off-by: Sabrina Dubroca Link: https://lore.kernel.org/r/335e32511ed55a0b30f3f81a78fa8f323b3bdf8f.1692977948.git.sd@queasysnail.netSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/tls/tls_device_fallback.c

8db44ab2 - tls: rename tls_cipher_size_desc to tls_cipher_desc

Fri, 25 Aug 2023 21:35:12 +0000

tls: rename tls_cipher_size_desc to tls_cipher_descWe're going to add other fields to it to fully describe a cipher, sothe "_size" name won't match the contents.Signed-off-by: Sabrina Dubroca Link: https://lore.kernel.org/r/76ca6c7686bd6d1534dfa188fb0f1f6fabebc791.1692977948.git.sd@queasysnail.netSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/tls/tls_device_fallback.c

037303d6 - tls: reduce size of tls_cipher_size_desc

Fri, 25 Aug 2023 21:35:11 +0000

tls: reduce size of tls_cipher_size_desctls_cipher_size_desc indexes ciphers by their type, but we're notusing indices 0..50 of the array. Each struct tls_cipher_size_desc is20B, so that's a lot of unused memory. We can reindex the arraystarting at the lowest used cipher_type.Introduce the get_cipher_size_desc helper to find the right item andavoid out-of-bounds accesses, and make tls_cipher_size_desc's sizeexplicit so that gcc reminds us to update TLS_CIPHER_MIN/MAX when weadd a new cipher.Signed-off-by: Sabrina Dubroca Link: https://lore.kernel.org/r/5e054e370e240247a5d37881a1cd93a67c15f4ca.1692977948.git.sd@queasysnail.netSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/tls/tls_device_fallback.c

a0e128ef - net/tls: fix comment typo

Thu, 22 Jun 2023 01:26:33 +0000

net/tls: fix comment typoSpell "retransmit" properly.Found by searching for keyword "tranm".Signed-off-by: Yueh-Shun Li Link: https://lore.kernel.org/r/20230622012627.15050-7-shamrocklee@posteo.netSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/tls/tls_device_fallback.c

0834ced6 - net/tls: Fix memory leak in tls_enc_skb() and tls_sw_fallback_init()

Thu, 10 Nov 2022 09:03:29 +0000

net/tls: Fix memory leak in tls_enc_skb() and tls_sw_fallback_init()'aead_req' and 'aead_send' is allocated but not freed in default switchcase. This commit fixes the potential memory leak by freeing them underthe situation.Note that the default cases here should never be reached as they'dmean we allowed offloading an unsupported algorithm.Fixes: ea7a9d88ba21 ("net/tls: Use cipher sizes structs")Signed-off-by: Yu Liao Reviewed-by: Gal Pressman Link: https://lore.kernel.org/r/20221110090329.2036382-1-liaoyu15@huawei.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/tls/tls_device_fallback.c

56e5a6d3 - net/tls: Support 256 bit keys with TX device offload

Tue, 20 Sep 2022 13:01:49 +0000

net/tls: Support 256 bit keys with TX device offloadAdd the missing clause for 256 bit keys in tls_set_device_offload(), andthe needed adjustments in tls_device_fallback.c.Reviewed-by: Tariq Toukan Signed-off-by: Gal Pressman Signed-off-by: Jakub Kicinski List of files: /linux-6.15/net/tls/tls_device_fallback.c

ea7a9d88 - net/tls: Use cipher sizes structs

Tue, 20 Sep 2022 13:01:48 +0000

net/tls: Use cipher sizes structsUse the newly introduced cipher sizes structs instead of the repeatedswitch cases churn.Reviewed-by: Tariq Toukan Signed-off-by: Gal Pressman Signed-off-by: Jakub Kicinski List of files: /linux-6.15/net/tls/tls_device_fallback.c

94ce3b64 - net/tls: Use RCU API to access tls_ctx->netdev

Wed, 10 Aug 2022 08:16:02 +0000

net/tls: Use RCU API to access tls_ctx->netdevCurrently, tls_device_down synchronizes with tls_device_resync_rx usingRCU, however, the pointer to netdev is stored using WRITE_ONCE andloaded using READ_ONCE.Although such approach is technically correct (rcu_dereference isessentially a READ_ONCE, and rcu_assign_pointer uses WRITE_ONCE to storeNULL), using special RCU helpers for pointers is more valid, as itincludes additional checks and might change the implementationtransparently to the callers.Mark the netdev pointer as __rcu and use the correct RCU helpers toaccess it. For non-concurrent access pass the right conditions thatguarantee safe access (locks taken, refcount value). Also use thecorrect helper in mlx5e, where even READ_ONCE was missing.The transition to RCU exposes existing issues, fixed by this commit:1. bond_tls_device_xmit could read netdev twice, and it could becomeNULL the second time, after the NULL check passed.2. Drivers shouldn't stop processing the last packet if tls_device_downjust set netdev to NULL, before tls_dev_del was called. This prevents apossible packet drop when transitioning to the fallback software mode.Fixes: 89df6a810470 ("net/bonding: Implement TLS TX device offload")Fixes: c55dcdd435aa ("net/tls: Fix use-after-free after the TLS device goes down and up")Signed-off-by: Maxim Mikityanskiy Link: https://lore.kernel.org/r/20220810081602.1435800-1-maximmi@nvidia.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/tls/tls_device_fallback.c

58790314 - tls: create an internal header

Fri, 08 Jul 2022 01:03:13 +0000

tls: create an internal headerinclude/net/tls.h is getting a little long, and is probably hardfor driver authors to navigate. Split out the internals into aheader which will live under net/tls/. While at it move somestatic inlines with a single user into the source files, adda few tls_ prefixes and fix spelling of 'proccess'.Signed-off-by: Jakub Kicinski List of files: /linux-6.15/net/tls/tls_device_fallback.c

504148fe - net: add skb_[inner_]tcp_all_headers helpers

Thu, 30 Jun 2022 15:07:50 +0000

net: add skb_[inner_]tcp_all_headers helpersMost drivers use "skb_transport_offset(skb) + tcp_hdrlen(skb)"to compute headers length for a TCP packet, but othersuse more convoluted (but equivalent) ways.Add skb_tcp_all_headers() and skb_inner_tcp_all_headers()helpers to harmonize this a bit.Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller List of files: /linux-6.15/net/tls/tls_device_fallback.c

c55dcdd4 - net/tls: Fix use-after-free after the TLS device goes down and up

Tue, 01 Jun 2021 12:08:00 +0000

net/tls: Fix use-after-free after the TLS device goes down and upWhen a netdev with active TLS offload goes down, tls_device_down iscalled to stop the offload and tear down the TLS context. However, thesocket stays alive, and it still points to the TLS context, which is nowdeallocated. If a netdev goes up, while the connection is still active,and the data flow resumes after a number of TCP retransmissions, it willlead to a use-after-free of the TLS context.This commit addresses this bug by keeping the context alive until itsnormal destruction, and implements the necessary fallbacks, so that theconnection can resume in software (non-offloaded) kTLS mode.On the TX side tls_sw_fallback is used to encrypt all packets. The RXside already has all the necessary fallbacks, because receivingnon-decrypted packets is supported. The thing needed on the RX side isto block resync requests, which are normally produced after receivingnon-decrypted packets.The necessary synchronization is implemented for a graceful teardown:first the fallbacks are deployed, then the driver resources are released(it used to be possible to have a tls_dev_resync after tls_dev_del).A new flag called TLS_RX_DEV_DEGRADED is added to indicate the fallbackmode. It's used to skip the RX resync logic completely, as it becomesuseless, and some objects may be released (for example, resync_async,which is allocated and freed by the driver).Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure")Signed-off-by: Maxim Mikityanskiy Reviewed-by: Tariq Toukan Signed-off-by: David S. Miller List of files: /linux-6.15/net/tls/tls_device_fallback.c

4e5a7332 - net/tls: Except bond interface from some TLS checks

Sun, 17 Jan 2021 14:59:49 +0000

net/tls: Except bond interface from some TLS checksIn the tls_dev_event handler, ignore tlsdev_ops requirement for bondinterfaces, they do not exist as the interaction is done directly withthe lower device.Also, make the validate function pass when it's called with the upperbond interface.Signed-off-by: Tariq Toukan Reviewed-by: Boris Pismenny Signed-off-by: Jakub Kicinski List of files: /linux-6.15/net/tls/tls_device_fallback.c