Re: ipsec tdb error handling

2021-10-22 Thread Vitaliy Makkoveev
> On 22 Oct 2021, at 18:23, Alexander Bluhm wrote: > > On Thu, Oct 21, 2021 at 03:04:22PM +0300, Vitaliy Makkoveev wrote: >> With this diff the `tdb' dereference after tdb_free() is safe enough and >> I have no objections against your diff. > > My diff did not make things worse, it counted th

Re: ipsec tdb error handling

2021-10-22 Thread Alexander Bluhm
On Thu, Oct 21, 2021 at 03:04:22PM +0300, Vitaliy Makkoveev wrote: > With this diff the `tdb' dereference after tdb_free() is safe enough and > I have no objections against your diff. My diff did not make things worse, it counted the drops earlier. But I decided to drop that part, I would like jus

Re: ipsec tdb error handling

2021-10-21 Thread Vitaliy Makkoveev
On Thu, Oct 21, 2021 at 12:08:57PM +0200, Alexander Bluhm wrote: > On Sat, Oct 16, 2021 at 12:50:46AM +0300, Vitaliy Makkoveev wrote: > > This time tdb_delete() doesn't kill passed `tdb' but schedules timeout > > to do this. So this `tdb' is logically killed and should be not used, > > but because

Re: ipsec tdb error handling

2021-10-21 Thread Alexander Bluhm
On Sat, Oct 16, 2021 at 12:50:46AM +0300, Vitaliy Makkoveev wrote: > This time tdb_delete() doesn't kill passed `tdb' but schedules timeout > to do this. So this `tdb' is logically killed and should be not used, > but because the killer timeout is also serialized with netlock we don;t > catch use-a

Re: ipsec tdb error handling

2021-10-15 Thread Vitaliy Makkoveev
Hi, This time tdb_delete() doesn't kill passed `tdb' but schedules timeout to do this. So this `tdb' is logically killed and should be not used, but because the killer timeout is also serialized with netlock we don;t catch use-after-free issue. This was the reason I reverted my "per-cpu counters

ipsec tdb error handling

2021-10-15 Thread Alexander Bluhm
Hi, Goal is to ref count the tdb in ipsec. For that the counters that access the tdb have to be pushed down the function hierarchie. While there adjust the error handling. Output functions should generate an errno. ok? bluhm Index: netinet/ip_ah.c =