Re: [PATCHv3] xfrm: dst_entries_init() per-net dst_ops

[Steffen Klassert]

On Thu, Oct 29, 2015 at 09:51:16AM -0400, Dan Streetman wrote:
> Remove the dst_entries_init/destroy calls for xfrm4 and xfrm6 dst_ops
> templates; their dst_entries counters will never be used.  Move the
> xfrm dst_ops initialization from the common xfrm/xfrm_policy.c to
> xfrm4/xfrm4_policy.c and xfrm6/xfrm6_policy.c, and call dst_entries_init
> and dst_entries_destroy for each net namespace.
> 
> The ipv4 and ipv6 xfrms each create dst_ops template, and perform
> dst_entries_init on the templates.  The template values are copied to each
> net namespace's xfrm.xfrm*_dst_ops.  The problem there is the dst_ops
> pcpuc_entries field is a percpu counter and cannot be used correctly by
> simply copying it to another object.
> 
> The result of this is a very subtle bug; changes to the dst entries
> counter from one net namespace may sometimes get applied to a different
> net namespace dst entries counter.  This is because of how the percpu
> counter works; it has a main count field as well as a pointer to the
> percpu variables.  Each net namespace maintains its own main count
> variable, but all point to one set of percpu variables.  When any net
> namespace happens to change one of the percpu variables to outside its
> small batch range, its count is moved to the net namespace's main count
> variable.  So with multiple net namespaces operating concurrently, the
> dst_ops entries counter can stray from the actual value that it should
> be; if counts are consistently moved from one net namespace to another
> (which my testing showed is likely), then one net namespace winds up
> with a negative dst_ops count while another winds up with a continually
> increasing count, eventually reaching its gc_thresh limit, which causes
> all new traffic on the net namespace to fail with -ENOBUFS.
> 
> Signed-off-by: Dan Streetman 
> Signed-off-by: Dan Streetman 

Applied to the ipsec tree, thanks Dan!
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCHv3] xfrm: dst_entries_init() per-net dst_ops

[Dan Streetman]

Remove the dst_entries_init/destroy calls for xfrm4 and xfrm6 dst_ops
templates; their dst_entries counters will never be used.  Move the
xfrm dst_ops initialization from the common xfrm/xfrm_policy.c to
xfrm4/xfrm4_policy.c and xfrm6/xfrm6_policy.c, and call dst_entries_init
and dst_entries_destroy for each net namespace.

The ipv4 and ipv6 xfrms each create dst_ops template, and perform
dst_entries_init on the templates.  The template values are copied to each
net namespace's xfrm.xfrm*_dst_ops.  The problem there is the dst_ops
pcpuc_entries field is a percpu counter and cannot be used correctly by
simply copying it to another object.

The result of this is a very subtle bug; changes to the dst entries
counter from one net namespace may sometimes get applied to a different
net namespace dst entries counter.  This is because of how the percpu
counter works; it has a main count field as well as a pointer to the
percpu variables.  Each net namespace maintains its own main count
variable, but all point to one set of percpu variables.  When any net
namespace happens to change one of the percpu variables to outside its
small batch range, its count is moved to the net namespace's main count
variable.  So with multiple net namespaces operating concurrently, the
dst_ops entries counter can stray from the actual value that it should
be; if counts are consistently moved from one net namespace to another
(which my testing showed is likely), then one net namespace winds up
with a negative dst_ops count while another winds up with a continually
increasing count, eventually reaching its gc_thresh limit, which causes
all new traffic on the net namespace to fail with -ENOBUFS.

Signed-off-by: Dan Streetman 
Signed-off-by: Dan Streetman 
---
Changes since v2:
 remove no longer needed struct net *net stack var
Changes since v1:
 move dst copying and entries_init from xfrm/xfrm_policy into
   ipv[46]/xfrm[46]_policy
 add dst_entries_init and destroy to xfrm[46]_policy pernet init/exit,
   so no for_each_net() is required

 net/ipv4/xfrm4_policy.c | 46 +-
 net/ipv6/xfrm6_policy.c | 53 +++--
 net/xfrm/xfrm_policy.c  | 38 ---
 3 files changed, 75 insertions(+), 62 deletions(-)

diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index f2606b9..59ce2b9 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -235,7 +235,7 @@ static void xfrm4_dst_ifdown(struct dst_entry *dst, struct 
net_device *dev,
xfrm_dst_ifdown(dst, dev);
 }
 
-static struct dst_ops xfrm4_dst_ops = {
+static struct dst_ops xfrm4_dst_ops_template = {
.family =   AF_INET,
.gc =   xfrm4_garbage_collect,
.update_pmtu =  xfrm4_update_pmtu,
@@ -249,7 +249,7 @@ static struct dst_ops xfrm4_dst_ops = {
 
 static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
.family =   AF_INET,
-   .dst_ops =  _dst_ops,
+   .dst_ops =  _dst_ops_template,
.dst_lookup =   xfrm4_dst_lookup,
.get_saddr =xfrm4_get_saddr,
.decode_session =   _decode_session4,
@@ -271,7 +271,7 @@ static struct ctl_table xfrm4_policy_table[] = {
{ }
 };
 
-static int __net_init xfrm4_net_init(struct net *net)
+static int __net_init xfrm4_net_sysctl_init(struct net *net)
 {
struct ctl_table *table;
struct ctl_table_header *hdr;
@@ -299,7 +299,7 @@ err_alloc:
return -ENOMEM;
 }
 
-static void __net_exit xfrm4_net_exit(struct net *net)
+static void __net_exit xfrm4_net_sysctl_exit(struct net *net)
 {
struct ctl_table *table;
 
@@ -311,12 +311,44 @@ static void __net_exit xfrm4_net_exit(struct net *net)
if (!net_eq(net, _net))
kfree(table);
 }
+#else /* CONFIG_SYSCTL */
+static int inline xfrm4_net_sysctl_init(struct net *net)
+{
+   return 0;
+}
+
+static void inline xfrm4_net_sysctl_exit(struct net *net)
+{
+}
+#endif
+
+static int __net_init xfrm4_net_init(struct net *net)
+{
+   int ret;
+
+   memcpy(>xfrm.xfrm4_dst_ops, _dst_ops_template,
+  sizeof(xfrm4_dst_ops_template));
+   ret = dst_entries_init(>xfrm.xfrm4_dst_ops);
+   if (ret)
+   return ret;
+
+   ret = xfrm4_net_sysctl_init(net);
+   if (ret)
+   dst_entries_destroy(>xfrm.xfrm4_dst_ops);
+
+   return ret;
+}
+
+static void __net_exit xfrm4_net_exit(struct net *net)
+{
+   xfrm4_net_sysctl_exit(net);
+   dst_entries_destroy(>xfrm.xfrm4_dst_ops);
+}
 
 static struct pernet_operations __net_initdata xfrm4_net_ops = {
.init   = xfrm4_net_init,
.exit   = xfrm4_net_exit,
 };
-#endif
 
 static void __init xfrm4_policy_init(void)
 {
@@ -325,13 +357,9 @@ static void __init xfrm4_policy_init(void)
 
 void __init xfrm4_init(void)
 {
-