[PATCH net V3 5/8] net/mlx5e: Fix ipsec core device access during profile changes
From: Tariq Toukan
Date: Thu Nov 05 2026 - 16:32:56 EST
From: Cosmin Ratiu <cratiu@xxxxxxxxxx>
Devlink E-Switch mode changes replace the netdev profile without
unregistering the netdev. XFRM state and policy creation can therefore
run while mlx5e_priv_cleanup() clears priv with memset() or
mlx5e_priv_init() initializes it again. Accesses to priv->mdev can
observe NULL or a torn pointer, and repeated loads may return different
values.
Read priv->mdev once in each add callback and use the saved pointer
throughout the callback, including error unwinding. The core device
survives the in-place profile change, so a saved non-NULL pointer
remains valid even if priv is cleared in the meantime.
A NULL priv->mdev means a profile change is in progress, which only
happens during an eswitch mode change. Return -EBUSY in that case, as
mlx5_eswitch_block_mode() does for the same mode change. -EOPNOTSUPP
would make xfrm_dev_state_add() silently fall back to software for a
crypto offload SA for its whole lifetime.
Use WRITE_ONCE() when initializing priv->mdev and when clearing it
before memset(). This makes the transition to NULL atomic; the
subsequent bulk clear only writes zero bytes over an already NULL
pointer. Annotate the READ_ONCE() snapshots with data_race() to allow
that harmless overlap with the unmarked memset() without suppressing
checks for the rest of priv.
This fixes the core-device pointer accesses. Protecting the IPsec
context itself during state and policy creation is handled separately.
This was found by Sashiko, during review of the next patches in the
series. No attempt was made at reproducing this race, the chances seem
vanishingly small.
Fixes: 7a9fb35e8c3a ("net/mlx5e: Do not reload ethernet ports when changing eswitch mode")
Signed-off-by: Cosmin Ratiu <cratiu@xxxxxxxxxx>
Reviewed-by: Jianbo Liu <jianbol@xxxxxxxxxx>
Signed-off-by: Tariq Toukan <tariqt@xxxxxxxxxx>
---
.../mellanox/mlx5/core/en_accel/ipsec.c | 38 +++++++++++++------
.../net/ethernet/mellanox/mlx5/core/en_main.c | 4 +-
2 files changed, 30 insertions(+), 12 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
index 7bc5d07b4321..33a7434a7bb9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
@@ -773,12 +773,20 @@ static int mlx5e_xfrm_add_state(struct net_device *dev,
{
struct mlx5e_ipsec_sa_entry *sa_entry = NULL;
bool allow_tunnel_mode = false;
+ struct mlx5_core_dev *mdev;
struct mlx5e_ipsec *ipsec;
struct mlx5e_priv *priv;
gfp_t gfp;
int err;
priv = netdev_priv(dev);
+ /* Profile cleanup can memset an already NULL mdev. */
+ mdev = data_race(READ_ONCE(priv->mdev));
+ /* NULL only during a profile change, which is an eswitch operation. */
+ if (!mdev) {
+ NL_SET_ERR_MSG_MOD(extack, "Eswitch busy, can't add state");
+ return -EBUSY;
+ }
if (!priv->ipsec)
return -EOPNOTSUPP;
@@ -797,16 +805,16 @@ static int mlx5e_xfrm_add_state(struct net_device *dev,
return 0;
}
- err = mlx5e_xfrm_validate_state(priv->mdev, x, extack);
+ err = mlx5e_xfrm_validate_state(mdev, x, extack);
if (err)
goto err_xfrm;
- if (!mlx5_eswitch_block_ipsec(priv->mdev)) {
+ if (!mlx5_eswitch_block_ipsec(mdev)) {
err = -EBUSY;
goto err_xfrm;
}
- err = mlx5_eswitch_block_mode(priv->mdev);
+ err = mlx5_eswitch_block_mode(mdev);
if (err)
goto unblock_ipsec;
@@ -877,9 +885,9 @@ static int mlx5e_xfrm_add_state(struct net_device *dev,
x->xso.offload_handle = (unsigned long)sa_entry;
if (allow_tunnel_mode)
- mlx5_eswitch_unblock_encap(priv->mdev);
+ mlx5_eswitch_unblock_encap(mdev);
- mlx5_eswitch_unblock_mode(priv->mdev);
+ mlx5_eswitch_unblock_mode(mdev);
return 0;
@@ -895,11 +903,11 @@ static int mlx5e_xfrm_add_state(struct net_device *dev,
kfree(sa_entry->work);
unblock_encap:
if (allow_tunnel_mode)
- mlx5_eswitch_unblock_encap(priv->mdev);
+ mlx5_eswitch_unblock_encap(mdev);
unblock_mode:
- mlx5_eswitch_unblock_mode(priv->mdev);
+ mlx5_eswitch_unblock_mode(mdev);
unblock_ipsec:
- mlx5_eswitch_unblock_ipsec(priv->mdev);
+ mlx5_eswitch_unblock_ipsec(mdev);
err_xfrm:
kfree(sa_entry);
NL_SET_ERR_MSG_WEAK_MOD(extack, "Device failed to offload this state");
@@ -1268,16 +1276,24 @@ static int mlx5e_xfrm_add_policy(struct xfrm_policy *x,
{
struct net_device *netdev = x->xdo.dev;
struct mlx5e_ipsec_pol_entry *pol_entry;
+ struct mlx5_core_dev *mdev;
struct mlx5e_priv *priv;
int err;
priv = netdev_priv(netdev);
+ /* Profile cleanup can memset an already NULL mdev. */
+ mdev = data_race(READ_ONCE(priv->mdev));
+ if (!mdev) {
+ NL_SET_ERR_MSG_MOD(extack, "Eswitch busy, can't add policy");
+ return -EBUSY;
+ }
+
if (!priv->ipsec) {
NL_SET_ERR_MSG_MOD(extack, "Device doesn't support IPsec packet offload");
return -EOPNOTSUPP;
}
- err = mlx5e_xfrm_validate_policy(priv->mdev, x, extack);
+ err = mlx5e_xfrm_validate_policy(mdev, x, extack);
if (err)
return err;
@@ -1288,7 +1304,7 @@ static int mlx5e_xfrm_add_policy(struct xfrm_policy *x,
pol_entry->x = x;
pol_entry->ipsec = priv->ipsec;
- if (!mlx5_eswitch_block_ipsec(priv->mdev)) {
+ if (!mlx5_eswitch_block_ipsec(mdev)) {
err = -EBUSY;
goto ipsec_busy;
}
@@ -1302,7 +1318,7 @@ static int mlx5e_xfrm_add_policy(struct xfrm_policy *x,
return 0;
err_fs:
- mlx5_eswitch_unblock_ipsec(priv->mdev);
+ mlx5_eswitch_unblock_ipsec(mdev);
ipsec_busy:
kfree(pol_entry);
NL_SET_ERR_MSG_MOD(extack, "Device failed to offload this policy");
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index c3c2c5720c6f..5cf3362259fc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -6382,7 +6382,7 @@ int mlx5e_priv_init(struct mlx5e_priv *priv,
node = dev_to_node(mlx5_core_dma_dev(mdev));
/* priv init */
- priv->mdev = mdev;
+ WRITE_ONCE(priv->mdev, mdev);
priv->netdev = netdev;
priv->max_nch = nch;
priv->max_opened_tc = 1;
@@ -6467,6 +6467,8 @@ void mlx5e_priv_cleanup(struct mlx5e_priv *priv)
mlx5e_mqprio_rl_free(priv->mqprio_rl);
}
+ /* Clear atomically before memset() for lockless XFRM readers. */
+ WRITE_ONCE(priv->mdev, NULL);
memset(priv, 0, sizeof(*priv));
if (destroying) /* restore destroying bit, to allow unload */
set_bit(MLX5E_STATE_DESTROYING, &priv->state);
--
2.44.0