Commit 2e19ef02 authored by David S. Miller's avatar David S. Miller

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec

Steffen Klassert says:

====================
1) Fix a possible race on ipcomp scratch buffers because
   of too early enabled siftirqs. From Michal Kubecek.

2) The current xfrm garbage collector threshold is too small
   for some workloads, resulting in bad performance on these
   workloads. Increase the threshold from 1024 to 32768.

3) Some codepaths might not have a dst_entry attached to the
   skb when calling xfrm_decode_session(). So add a check
   to prevent a null pointer dereference in this case.
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents c17cb8b5 84502b5e
...@@ -104,10 +104,14 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse) ...@@ -104,10 +104,14 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
const struct iphdr *iph = ip_hdr(skb); const struct iphdr *iph = ip_hdr(skb);
u8 *xprth = skb_network_header(skb) + iph->ihl * 4; u8 *xprth = skb_network_header(skb) + iph->ihl * 4;
struct flowi4 *fl4 = &fl->u.ip4; struct flowi4 *fl4 = &fl->u.ip4;
int oif = 0;
if (skb_dst(skb))
oif = skb_dst(skb)->dev->ifindex;
memset(fl4, 0, sizeof(struct flowi4)); memset(fl4, 0, sizeof(struct flowi4));
fl4->flowi4_mark = skb->mark; fl4->flowi4_mark = skb->mark;
fl4->flowi4_oif = skb_dst(skb)->dev->ifindex; fl4->flowi4_oif = reverse ? skb->skb_iif : oif;
if (!ip_is_fragment(iph)) { if (!ip_is_fragment(iph)) {
switch (iph->protocol) { switch (iph->protocol) {
...@@ -236,7 +240,7 @@ static struct dst_ops xfrm4_dst_ops = { ...@@ -236,7 +240,7 @@ static struct dst_ops xfrm4_dst_ops = {
.destroy = xfrm4_dst_destroy, .destroy = xfrm4_dst_destroy,
.ifdown = xfrm4_dst_ifdown, .ifdown = xfrm4_dst_ifdown,
.local_out = __ip_local_out, .local_out = __ip_local_out,
.gc_thresh = 1024, .gc_thresh = 32768,
}; };
static struct xfrm_policy_afinfo xfrm4_policy_afinfo = { static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
......
...@@ -135,10 +135,14 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse) ...@@ -135,10 +135,14 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
struct ipv6_opt_hdr *exthdr; struct ipv6_opt_hdr *exthdr;
const unsigned char *nh = skb_network_header(skb); const unsigned char *nh = skb_network_header(skb);
u8 nexthdr = nh[IP6CB(skb)->nhoff]; u8 nexthdr = nh[IP6CB(skb)->nhoff];
int oif = 0;
if (skb_dst(skb))
oif = skb_dst(skb)->dev->ifindex;
memset(fl6, 0, sizeof(struct flowi6)); memset(fl6, 0, sizeof(struct flowi6));
fl6->flowi6_mark = skb->mark; fl6->flowi6_mark = skb->mark;
fl6->flowi6_oif = skb_dst(skb)->dev->ifindex; fl6->flowi6_oif = reverse ? skb->skb_iif : oif;
fl6->daddr = reverse ? hdr->saddr : hdr->daddr; fl6->daddr = reverse ? hdr->saddr : hdr->daddr;
fl6->saddr = reverse ? hdr->daddr : hdr->saddr; fl6->saddr = reverse ? hdr->daddr : hdr->saddr;
...@@ -285,7 +289,7 @@ static struct dst_ops xfrm6_dst_ops = { ...@@ -285,7 +289,7 @@ static struct dst_ops xfrm6_dst_ops = {
.destroy = xfrm6_dst_destroy, .destroy = xfrm6_dst_destroy,
.ifdown = xfrm6_dst_ifdown, .ifdown = xfrm6_dst_ifdown,
.local_out = __ip6_local_out, .local_out = __ip6_local_out,
.gc_thresh = 1024, .gc_thresh = 32768,
}; };
static struct xfrm_policy_afinfo xfrm6_policy_afinfo = { static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
......
...@@ -141,14 +141,14 @@ static int ipcomp_compress(struct xfrm_state *x, struct sk_buff *skb) ...@@ -141,14 +141,14 @@ static int ipcomp_compress(struct xfrm_state *x, struct sk_buff *skb)
const int plen = skb->len; const int plen = skb->len;
int dlen = IPCOMP_SCRATCH_SIZE; int dlen = IPCOMP_SCRATCH_SIZE;
u8 *start = skb->data; u8 *start = skb->data;
const int cpu = get_cpu(); struct crypto_comp *tfm;
u8 *scratch = *per_cpu_ptr(ipcomp_scratches, cpu); u8 *scratch;
struct crypto_comp *tfm = *per_cpu_ptr(ipcd->tfms, cpu);
int err; int err;
local_bh_disable(); local_bh_disable();
scratch = *this_cpu_ptr(ipcomp_scratches);
tfm = *this_cpu_ptr(ipcd->tfms);
err = crypto_comp_compress(tfm, start, plen, scratch, &dlen); err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
local_bh_enable();
if (err) if (err)
goto out; goto out;
...@@ -158,13 +158,13 @@ static int ipcomp_compress(struct xfrm_state *x, struct sk_buff *skb) ...@@ -158,13 +158,13 @@ static int ipcomp_compress(struct xfrm_state *x, struct sk_buff *skb)
} }
memcpy(start + sizeof(struct ip_comp_hdr), scratch, dlen); memcpy(start + sizeof(struct ip_comp_hdr), scratch, dlen);
put_cpu(); local_bh_enable();
pskb_trim(skb, dlen + sizeof(struct ip_comp_hdr)); pskb_trim(skb, dlen + sizeof(struct ip_comp_hdr));
return 0; return 0;
out: out:
put_cpu(); local_bh_enable();
return err; return err;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment