From mboxrd@z Thu Jan  1 00:00:00 1970
From: Christoph Paasch <cpaasch@apple.com>
Subject: Re: [PATCH net-next 1/5] tcp: Create list of TFO-contexts
Date: Mon, 17 Dec 2018 13:57:25 -0800
Message-ID: <20181217215725.GZ41383@MacBook-Pro-19.local>
References: <20181214224007.54813-1-cpaasch@apple.com>
 <20181214224007.54813-2-cpaasch@apple.com>
 <CANn89iKHt4gr5C2S-t1386x4E_fv38KGk4QARPesAWXsThR4Fw@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; CHARSET=US-ASCII
Content-Transfer-Encoding: 7BIT
Cc: netdev <netdev@vger.kernel.org>, Yuchung Cheng <ycheng@google.com>,
        David Miller <davem@davemloft.net>
To: Eric Dumazet <edumazet@google.com>
Return-path: <netdev-owner@vger.kernel.org>
Received: from nwk-aaemail-lapp02.apple.com ([17.151.62.67]:35588 "EHLO
        nwk-aaemail-lapp02.apple.com" rhost-flags-OK-OK-OK-OK)
        by vger.kernel.org with ESMTP id S1727602AbeLQV5a (ORCPT
        <rfc822;netdev@vger.kernel.org>); Mon, 17 Dec 2018 16:57:30 -0500
Content-disposition: inline
In-reply-to: <CANn89iKHt4gr5C2S-t1386x4E_fv38KGk4QARPesAWXsThR4Fw@mail.gmail.com>
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>

On 17/12/18 - 08:04:08, Eric Dumazet wrote:
> On Fri, Dec 14, 2018 at 2:40 PM Christoph Paasch <cpaasch@apple.com> wrote:
> >
> 
> ...
> 
> >  int tcp_fastopen_reset_cipher(struct net *net, struct sock *sk,
> >                               void *key, unsigned int len)
> >  {
> > @@ -96,13 +131,22 @@ error:             kfree(ctx);
> >         spin_lock(&net->ipv4.tcp_fastopen_ctx_lock);
> >         if (sk) {
> >                 q = &inet_csk(sk)->icsk_accept_queue.fastopenq;
> 
> > +               rcu_assign_pointer(ctx->next, q->ctx);
> At this point, ctx is not yet visible, so you do not need a barrier yet
>                     ctx->next = q->ctx;

Thanks, I will change that.

> 
> 
> > +               rcu_assign_pointer(q->ctx, ctx);
> 
> Note that readers could see 3 contexts in the chain, instead of maximum two.
> 
> This means that proc_tcp_fastopen_key() (your 3/5 change) would
> overflow an automatic array :
> 
> while (ctxt) {
>         memcpy(&key[i], ctxt->key, TCP_FASTOPEN_KEY_LENGTH);
>         i += 4;
>         ctxt = rcu_dereference(ctxt->next);
> }

Ouch! Thanks for spotting this.

If it's ok to have a brief moment of 3 contexts for the readers, I would
protect against overflows the readers.

> > +
> >                 octx = rcu_dereference_protected(q->ctx,
> >                         lockdep_is_held(&net->ipv4.tcp_fastopen_ctx_lock));
> > -               rcu_assign_pointer(q->ctx, ctx);
> > +
> > +               octx = tcp_fastopen_cut_keypool(octx, &net->ipv4.tcp_fastopen_ctx_lock);
> >         } else {
> > +               rcu_assign_pointer(ctx->next, net->ipv4.tcp_fastopen_ctx);
> 
> same remark here.

Same, will change that.


Christoph

> > +               rcu_assign_pointer(net->ipv4.tcp_fastopen_ctx, ctx);
> > +
> >                 octx = rcu_dereference_protected(net->ipv4.tcp_fastopen_ctx,
> >                         lockdep_is_held(&net->ipv4.tcp_fastopen_ctx_lock));
> > -               rcu_assign_pointer(net->ipv4.tcp_fastopen_ctx, ctx);
> > +
> > +               octx = tcp_fastopen_cut_keypool(octx,
> > +                                               &net->ipv4.tcp_fastopen_ctx_lock);
> >         }
> >         spin_unlock(&net->ipv4.tcp_fastopen_ctx_lock);
> >
> > --
> > 2.16.2
> >