Re: [PATCH net-next] net/tls: fix race condition causing kernel panic

2020-05-21 Thread Jakub Kicinski
On Fri, 22 May 2020 02:02:10 +0530 Vinay Kumar Yadav wrote: > When writer reads pending == 0, > that means completion is already called complete(). > its okay writer to initialize completion. When writer reads pending == 1, > that means writer is going to wait for completion. > > This way, writer

Re: [PATCH net-next] net/tls: fix race condition causing kernel panic

2020-05-21 Thread David Miller
From: Vinay Kumar Yadav Date: Fri, 22 May 2020 01:54:25 +0530 > I am explaining that your scenario is covered in this fix. Please change your commit message to be more readable in this way, thank you.

Re: [PATCH net-next] net/tls: fix race condition causing kernel panic

2020-05-21 Thread Vinay Kumar Yadav
Jakub On 5/22/2020 12:26 AM, Jakub Kicinski wrote: On Thu, 21 May 2020 14:28:27 +0530 Vinay Kumar Yadav wrote: Considering the lock in fix ("pending" is local variable), when writer reads pending == 0 [pending = atomic_read(&ctx->encrypt_pending); --> from tls_sw_sendmsg()], that means encrypt

Re: [PATCH net-next] net/tls: fix race condition causing kernel panic

2020-05-21 Thread Jakub Kicinski
On Thu, 21 May 2020 14:28:27 +0530 Vinay Kumar Yadav wrote: > Considering the lock in fix ("pending" is local variable), when writer reads > pending == 0 [pending = atomic_read(&ctx->encrypt_pending); --> from > tls_sw_sendmsg()], > that means encrypt complete() [from tls_encrypt_done()] is alread

Re: [PATCH net-next] net/tls: fix race condition causing kernel panic

2020-05-21 Thread Vinay Kumar Yadav
Jakub On 5/21/2020 1:28 AM, Jakub Kicinski wrote: On Wed, 20 May 2020 22:39:11 +0530 Vinay Kumar Yadav wrote: On 5/20/2020 12:46 AM, David Miller wrote: From: Vinay Kumar Yadav Date: Tue, 19 May 2020 13:13:27 +0530 + spin_lock_bh(&ctx->encrypt_compl_lock); + pe

Re: [PATCH net-next] net/tls: fix race condition causing kernel panic

2020-05-20 Thread Jakub Kicinski
On Wed, 20 May 2020 22:39:11 +0530 Vinay Kumar Yadav wrote: > On 5/20/2020 12:46 AM, David Miller wrote: > > From: Vinay Kumar Yadav > > Date: Tue, 19 May 2020 13:13:27 +0530 > > > >> + spin_lock_bh(&ctx->encrypt_compl_lock); > >> + pending = atomic_read(&ctx->encrypt_pending);

Re: [PATCH net-next] net/tls: fix race condition causing kernel panic

2020-05-20 Thread Vinay Kumar Yadav
David On 5/20/2020 12:46 AM, David Miller wrote: From: Vinay Kumar Yadav Date: Tue, 19 May 2020 13:13:27 +0530 + spin_lock_bh(&ctx->encrypt_compl_lock); + pending = atomic_read(&ctx->encrypt_pending); + spin_unlock_bh(&ctx->encrypt_compl_lock); The s

Re: [PATCH net-next] net/tls: fix race condition causing kernel panic

2020-05-19 Thread David Miller
From: Vinay Kumar Yadav Date: Tue, 19 May 2020 13:13:27 +0530 > + spin_lock_bh(&ctx->encrypt_compl_lock); > + pending = atomic_read(&ctx->encrypt_pending); > + spin_unlock_bh(&ctx->encrypt_compl_lock); The sequence: lock(); x = p->y; u

[PATCH net-next] net/tls: fix race condition causing kernel panic

2020-05-19 Thread Vinay Kumar Yadav
tls_sw_recvmsg() and tls_decrypt_done() can be run concurrently. consider the scenario tls_decrypt_done() is about to run complete() and tls_sw_recvmsg() completed reinit_completion() then tls_decrypt_done() runs complete(). This sequence of execution results in wrong completion (ctx->async_wait.co