Commit 7ba91ecb authored by Jesper Dangaard Brouer's avatar Jesper Dangaard Brouer Committed by David S. Miller
Browse files

net: for rate-limited ICMP replies save one atomic operation 



It is possible to avoid the atomic operation in icmp{v6,}_xmit_lock,
by checking the sysctl_icmp_msgs_per_sec ratelimit before these calls,
as pointed out by Eric Dumazet, but the BH disabled state must be correct.

The icmp_global_allow() call states it must be called with BH
disabled.  This protection was given by the calls icmp_xmit_lock and
icmpv6_xmit_lock.  Thus, split out local_bh_disable/enable from these
functions and maintain it explicitly at callers.

Suggested-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
Acked-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c0303efe

net/ipv4/icmp.c

+21 −13
Original line number Original line Diff line number Diff line
@@ -209,19 +209,17 @@ static struct sock *icmp_sk(struct net *net) 
	return *this_cpu_ptr(net->ipv4.icmp_sk);

	return *this_cpu_ptr(net->ipv4.icmp_sk);

}

}





/* Called with BH disabled */

static inline struct sock *icmp_xmit_lock(struct net *net)

static inline struct sock *icmp_xmit_lock(struct net *net)

{

{

	struct sock *sk;

	struct sock *sk;





	local_bh_disable();



	sk = icmp_sk(net);

	sk = icmp_sk(net);





	if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {

	if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {

		/* This can happen if the output path signals a

		/* This can happen if the output path signals a

		 * dst_link_failure() for an outgoing ICMP packet.

		 * dst_link_failure() for an outgoing ICMP packet.

		 */

		 */

		local_bh_enable();

		return NULL;

		return NULL;

	}

	}

	return sk;

	return sk;
@@ -229,7 +227,7 @@ static inline struct sock *icmp_xmit_lock(struct net *net) 




static inline void icmp_xmit_unlock(struct sock *sk)

static inline void icmp_xmit_unlock(struct sock *sk)

{

{

	spin_unlock_bh(&sk->sk_lock.slock);

	spin_unlock(&sk->sk_lock.slock);

}

}





int sysctl_icmp_msgs_per_sec __read_mostly = 1000;

int sysctl_icmp_msgs_per_sec __read_mostly = 1000;
@@ -417,14 +415,17 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb) 
	if (ip_options_echo(&icmp_param->replyopts.opt.opt, skb))

	if (ip_options_echo(&icmp_param->replyopts.opt.opt, skb))

		return;

		return;





	sk = icmp_xmit_lock(net);

	/* Needed by both icmp_global_allow and icmp_xmit_lock */

	if (!sk)

	local_bh_disable();

		return;

	inet = inet_sk(sk);





	/* global icmp_msgs_per_sec */

	/* global icmp_msgs_per_sec */

	if (!icmpv4_global_allow(net, type, code))

	if (!icmpv4_global_allow(net, type, code))

		goto out_unlock;

		goto out_bh_enable;



	sk = icmp_xmit_lock(net);

	if (!sk)

		goto out_bh_enable;

	inet = inet_sk(sk);





	icmp_param->data.icmph.checksum = 0;

	icmp_param->data.icmph.checksum = 0;
@@ -459,6 +460,8 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb) 
	ip_rt_put(rt);

	ip_rt_put(rt);

out_unlock:

out_unlock:

	icmp_xmit_unlock(sk);

	icmp_xmit_unlock(sk);

out_bh_enable:

	local_bh_enable();

}

}





#ifdef CONFIG_IP_ROUTE_MULTIPATH

#ifdef CONFIG_IP_ROUTE_MULTIPATH
@@ -668,13 +671,16 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info) 
		}

		}

	}

	}





	sk = icmp_xmit_lock(net);

	/* Needed by both icmp_global_allow and icmp_xmit_lock */

	if (!sk)

	local_bh_disable();

		goto out;





	/* Check global sysctl_icmp_msgs_per_sec ratelimit */

	/* Check global sysctl_icmp_msgs_per_sec ratelimit */

	if (!icmpv4_global_allow(net, type, code))

	if (!icmpv4_global_allow(net, type, code))

		goto out_unlock;

		goto out_bh_enable;



	sk = icmp_xmit_lock(net);

	if (!sk)

		goto out_bh_enable;





	/*

	/*

	 *	Construct source address and options.

	 *	Construct source address and options.
@@ -750,6 +756,8 @@ ende: 
	ip_rt_put(rt);

	ip_rt_put(rt);

out_unlock:

out_unlock:

	icmp_xmit_unlock(sk);

	icmp_xmit_unlock(sk);

out_bh_enable:

	local_bh_enable();

out:;

out:;

}

}

EXPORT_SYMBOL(icmp_send);

EXPORT_SYMBOL(icmp_send);

net/ipv6/icmp.c

+16 −9
Original line number Original line Diff line number Diff line
@@ -110,19 +110,17 @@ static const struct inet6_protocol icmpv6_protocol = { 
	.flags		=	INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,

	.flags		=	INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,

};

};





/* Called with BH disabled */

static __inline__ struct sock *icmpv6_xmit_lock(struct net *net)

static __inline__ struct sock *icmpv6_xmit_lock(struct net *net)

{

{

	struct sock *sk;

	struct sock *sk;





	local_bh_disable();



	sk = icmpv6_sk(net);

	sk = icmpv6_sk(net);

	if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {

	if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {

		/* This can happen if the output path (f.e. SIT or

		/* This can happen if the output path (f.e. SIT or

		 * ip6ip6 tunnel) signals dst_link_failure() for an

		 * ip6ip6 tunnel) signals dst_link_failure() for an

		 * outgoing ICMP6 packet.

		 * outgoing ICMP6 packet.

		 */

		 */

		local_bh_enable();

		return NULL;

		return NULL;

	}

	}

	return sk;

	return sk;
@@ -130,7 +128,7 @@ static __inline__ struct sock *icmpv6_xmit_lock(struct net *net) 




static __inline__ void icmpv6_xmit_unlock(struct sock *sk)

static __inline__ void icmpv6_xmit_unlock(struct sock *sk)

{

{

	spin_unlock_bh(&sk->sk_lock.slock);

	spin_unlock(&sk->sk_lock.slock);

}

}





/*

/*
@@ -489,6 +487,13 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, 
		return;

		return;

	}

	}





	/* Needed by both icmp_global_allow and icmpv6_xmit_lock */

	local_bh_disable();



	/* Check global sysctl_icmp_msgs_per_sec ratelimit */

	if (!icmpv6_global_allow(type))

		goto out_bh_enable;



	mip6_addr_swap(skb);

	mip6_addr_swap(skb);





	memset(&fl6, 0, sizeof(fl6));

	memset(&fl6, 0, sizeof(fl6));
@@ -507,10 +512,7 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, 




	sk = icmpv6_xmit_lock(net);

	sk = icmpv6_xmit_lock(net);

	if (!sk)

	if (!sk)

		return;

		goto out_bh_enable;



	if (!icmpv6_global_allow(type))

		goto out;





	sk->sk_mark = mark;

	sk->sk_mark = mark;

	np = inet6_sk(sk);

	np = inet6_sk(sk);
@@ -571,6 +573,8 @@ out_dst_release: 
	dst_release(dst);

	dst_release(dst);

out:

out:

	icmpv6_xmit_unlock(sk);

	icmpv6_xmit_unlock(sk);

out_bh_enable:

	local_bh_enable();

}

}





/* Slightly more convenient version of icmp6_send.

/* Slightly more convenient version of icmp6_send.
@@ -684,9 +688,10 @@ static void icmpv6_echo_reply(struct sk_buff *skb) 
	fl6.flowi6_uid = sock_net_uid(net, NULL);

	fl6.flowi6_uid = sock_net_uid(net, NULL);

	security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));

	security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));





	local_bh_disable();

	sk = icmpv6_xmit_lock(net);

	sk = icmpv6_xmit_lock(net);

	if (!sk)

	if (!sk)

		return;

		goto out_bh_enable;

	sk->sk_mark = mark;

	sk->sk_mark = mark;

	np = inet6_sk(sk);

	np = inet6_sk(sk);
@@ -728,6 +733,8 @@ static void icmpv6_echo_reply(struct sk_buff *skb) 
	dst_release(dst);

	dst_release(dst);

out:

out:

	icmpv6_xmit_unlock(sk);

	icmpv6_xmit_unlock(sk);

out_bh_enable:

	local_bh_enable();

}

}





void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)

void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)

CRA Git | Maintained and supported by SUSTech CRA and CCSE