Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

net: netdevsim: use xso.real_dev instead of xso.dev in callback functions of struct xfrmdev_ops

There are two pointers in struct xfrm_state_offload, *dev, *real_dev.
These are used in callback functions of struct xfrmdev_ops.
The *dev points whether bonding interface or real interface.
If bonding ipsec offload is used, it points bonding interface If not,
it points real interface.
And real_dev always points real interface.
So, netdevsim should always use real_dev instead of dev.
Of course, real_dev always not be null.

Test commands:
ip netns add A
ip netns exec A bash
modprobe netdevsim
echo "1 1" > /sys/bus/netdevsim/new_device
ip link add bond0 type bond mode active-backup
ip link set eth0 master bond0
ip link set eth0 up
ip link set bond0 up
ip x s add proto esp dst 14.1.1.1 src 15.1.1.1 spi 0x07 mode \
transport reqid 0x07 replay-window 32 aead 'rfc4106(gcm(aes))' \
0x44434241343332312423222114131211f4f3f2f1 128 sel src 14.0.0.52/24 \
dst 14.0.0.70/24 proto tcp offload dev bond0 dir in

Splat looks like:
BUG: spinlock bad magic on CPU#5, kworker/5:1/53
lock: 0xffff8881068c2cc8, .magic: 11121314, .owner: <none>/-1,
.owner_cpu: -235736076
CPU: 5 PID: 53 Comm: kworker/5:1 Not tainted 5.13.0-rc3+ #1168
Workqueue: events linkwatch_event
Call Trace:
dump_stack+0xa4/0xe5
do_raw_spin_lock+0x20b/0x270
? rwlock_bug.part.1+0x90/0x90
_raw_spin_lock_nested+0x5f/0x70
bond_get_stats+0xe4/0x4c0 [bonding]
? rcu_read_lock_sched_held+0xc0/0xc0
? bond_neigh_init+0x2c0/0x2c0 [bonding]
? dev_get_alias+0xe2/0x190
? dev_get_port_parent_id+0x14a/0x360
? rtnl_unregister+0x190/0x190
? dev_get_phys_port_name+0xa0/0xa0
? memset+0x1f/0x40
? memcpy+0x38/0x60
? rtnl_phys_switch_id_fill+0x91/0x100
dev_get_stats+0x8c/0x270
rtnl_fill_stats+0x44/0xbe0
? nla_put+0xbe/0x140
rtnl_fill_ifinfo+0x1054/0x3ad0
[ ... ]

Fixes: 272c2330adc9 ("xfrm: bail early on slave pass over skb")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by

Taehee Yoo and committed by
David S. Miller
09adf756 105cd17a

+4 -4
+4 -4
drivers/net/netdevsim/ipsec.c
··· 85 85 u32 *mykey, u32 *mysalt) 86 86 { 87 87 const char aes_gcm_name[] = "rfc4106(gcm(aes))"; 88 - struct net_device *dev = xs->xso.dev; 88 + struct net_device *dev = xs->xso.real_dev; 89 89 unsigned char *key_data; 90 90 char *alg_name = NULL; 91 91 int key_len; ··· 134 134 u16 sa_idx; 135 135 int ret; 136 136 137 - dev = xs->xso.dev; 137 + dev = xs->xso.real_dev; 138 138 ns = netdev_priv(dev); 139 139 ipsec = &ns->ipsec; 140 140 ··· 194 194 195 195 static void nsim_ipsec_del_sa(struct xfrm_state *xs) 196 196 { 197 - struct netdevsim *ns = netdev_priv(xs->xso.dev); 197 + struct netdevsim *ns = netdev_priv(xs->xso.real_dev); 198 198 struct nsim_ipsec *ipsec = &ns->ipsec; 199 199 u16 sa_idx; 200 200 ··· 211 211 212 212 static bool nsim_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *xs) 213 213 { 214 - struct netdevsim *ns = netdev_priv(xs->xso.dev); 214 + struct netdevsim *ns = netdev_priv(xs->xso.real_dev); 215 215 struct nsim_ipsec *ipsec = &ns->ipsec; 216 216 217 217 ipsec->ok++;