Re: [PATCH net] net: drop secpath extension before skb deferral free

[Jianbo Liu <jianbol@nvidia.com>]

On Tue, 2024-05-14 at 10:51 +0200, Eric Dumazet wrote:
> On Tue, May 14, 2024 at 9:37 AM Jianbo Liu <jianbol@nvidia.com>
> wrote:
> > 
> > On Mon, 2024-05-13 at 12:29 +0200, Eric Dumazet wrote:
> > > On Mon, May 13, 2024 at 12:04 PM Jianbo Liu <jianbol@nvidia.com>
> > > wrote:
> > > 
> > > 
...
> > > This attribution and patch seem wrong. Also you should CC XFRM
> > > maintainers.
> > > 
> > > Before being freed from tcp_recvmsg() path, packets can sit in
> > > TCP
> > > receive queues for arbitrary amounts of time.
> > > 
> > > secpath_reset() should be called much earlier than in the code
> > > you
> > > tried to change.
> > 
> > Yes, this also fixed the issue if I moved secpatch_reset() before
> > tcp_v4_do_rcv().
> > 
> > --- a/net/ipv4/tcp_ipv4.c
> > +++ b/net/ipv4/tcp_ipv4.c
> > @@ -2314,6 +2314,7 @@ int tcp_v4_rcv(struct sk_buff *skb)
> >         tcp_v4_fill_cb(skb, iph, th);
> > 
> >         skb->dev = NULL;
> > +       secpath_reset(skb);
> > 
> >         if (sk->sk_state == TCP_LISTEN) {
> >                 ret = tcp_v4_do_rcv(sk, skb);
> > 
> > Do you want me to send v2, or push a new one if you agree with this
> > change?
> 
> That would only care about TCP and IPv4.
> 
> I think we need a full fix, not a partial work around to an immediate
> problem.
> 
> Can we have some feedback from Steffen, I  wonder if we missed
> something really obvious.
> 
> It is hard to believe this has been broken for such  a long time.

Could you please give me some suggestions?
Should I add new function to reset both ct and secpath, and replace
nf_reset_ct() where necessary on receive flow?

> 
> I think the issue came with
> 
> commit d77e38e612a017480157fe6d2c1422f42cb5b7e3
> Author: Steffen Klassert <steffen.klassert@secunet.com>
> Date:   Fri Apr 14 10:06:10 2017 +0200
> 
>     xfrm: Add an IPsec hardware offloading API
> 
>     This patch adds all the bits that are needed to do
>     IPsec hardware offload for IPsec states and ESP packets.
>     We add xfrmdev_ops to the net_device. xfrmdev_ops has
>     function pointers that are needed to manage the xfrm
>     states in the hardware and to do a per packet
>     offloading decision.
> 
>     Joint work with:
>     Ilan Tayari <ilant@mellanox.com>
>     Guy Shapiro <guysh@mellanox.com>
>     Yossi Kuperman <yossiku@mellanox.com>
> 
>     Signed-off-by: Guy Shapiro <guysh@mellanox.com>
>     Signed-off-by: Ilan Tayari <ilant@mellanox.com>
>     Signed-off-by: Yossi Kuperman <yossiku@mellanox.com>
>     Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
> 
> We should probably handle NETDEV_DOWN/NETDEV_UNREGISTER better,
> instead of adding  secpath_reset(skb) there and there.