Commit a84e3f53 authored by Florian Westphal's avatar Florian Westphal Committed by David S. Miller
Browse files

xfrm: prefer secpath_set over secpath_dup 



secpath_set is a wrapper for secpath_dup that will not perform
an allocation if the secpath attached to the skb has a reference count
of one, i.e., it doesn't need to be COW'ed.

Also, secpath_dup doesn't attach the secpath to the skb, it leaves
this to the caller.

Use secpath_set in places that immediately assign the return value to
skb.

This allows to remove skb->sp without touching these spots again.

secpath_dup can eventually be removed in followup patch.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent a053c866

drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c

+5 −4
Original line number Diff line number Diff line
@@ -1161,6 +1161,7 @@ void ixgbe_ipsec_rx(struct ixgbe_ring *rx_ring, 
	struct xfrm_state *xs = NULL;

	struct ipv6hdr *ip6 = NULL;

	struct iphdr *ip4 = NULL;

	struct sec_path *sp;

	void *daddr;

	__be32 spi;

	u8 *c_hdr;
@@ -1200,12 +1201,12 @@ void ixgbe_ipsec_rx(struct ixgbe_ring *rx_ring, 
	if (unlikely(!xs))

		return;



	skb->sp = secpath_dup(skb->sp);

	if (unlikely(!skb->sp))

	sp = secpath_set(skb);

	if (unlikely(!sp))

		return;



	skb->sp->xvec[skb->sp->len++] = xs;

	skb->sp->olen++;

	sp->xvec[sp->len++] = xs;

	sp->olen++;

	xo = xfrm_offload(skb);

	xo->flags = CRYPTO_DONE;

	xo->status = CRYPTO_SUCCESS;

drivers/net/ethernet/intel/ixgbevf/ipsec.c

+5 −4
Original line number Diff line number Diff line
@@ -548,6 +548,7 @@ void ixgbevf_ipsec_rx(struct ixgbevf_ring *rx_ring, 
	struct xfrm_state *xs = NULL;

	struct ipv6hdr *ip6 = NULL;

	struct iphdr *ip4 = NULL;

	struct sec_path *sp;

	void *daddr;

	__be32 spi;

	u8 *c_hdr;
@@ -587,12 +588,12 @@ void ixgbevf_ipsec_rx(struct ixgbevf_ring *rx_ring, 
	if (unlikely(!xs))

		return;



	skb->sp = secpath_dup(skb->sp);

	if (unlikely(!skb->sp))

	sp = secpath_set(skb);

	if (unlikely(!sp))

		return;



	skb->sp->xvec[skb->sp->len++] = xs;

	skb->sp->olen++;

	sp->xvec[sp->len++] = xs;

	sp->olen++;

	xo = xfrm_offload(skb);

	xo->flags = CRYPTO_DONE;

	xo->status = CRYPTO_SUCCESS;

drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c

+6 −4
Original line number Diff line number Diff line
@@ -307,10 +307,11 @@ mlx5e_ipsec_build_sp(struct net_device *netdev, struct sk_buff *skb, 
	struct mlx5e_priv *priv = netdev_priv(netdev);

	struct xfrm_offload *xo;

	struct xfrm_state *xs;

	struct sec_path *sp;

	u32 sa_handle;



	skb->sp = secpath_dup(skb->sp);

	if (unlikely(!skb->sp)) {

	sp = secpath_set(skb);

	if (unlikely(!sp)) {

		atomic64_inc(&priv->ipsec->sw_stats.ipsec_rx_drop_sp_alloc);

		return NULL;

	}
@@ -322,8 +323,9 @@ mlx5e_ipsec_build_sp(struct net_device *netdev, struct sk_buff *skb, 
		return NULL;

	}



	skb->sp->xvec[skb->sp->len++] = xs;

	skb->sp->olen++;

	sp = skb_sec_path(skb);

	sp->xvec[sp->len++] = xs;

	sp->olen++;



	xo = xfrm_offload(skb);

	xo->flags = CRYPTO_DONE;

net/xfrm/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -5,6 +5,7 @@ config XFRM 
       bool

       depends on NET

       select GRO_CELLS

       select SKB_EXTENSIONS



config XFRM_OFFLOAD

       bool

net/xfrm/xfrm_output.c

+2 −5
Original line number Diff line number Diff line
@@ -218,19 +218,16 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb) 
	if (xfrm_dev_offload_ok(skb, x)) {

		struct sec_path *sp;



		sp = secpath_dup(skb->sp);

		sp = secpath_set(skb);

		if (!sp) {

			XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);

			kfree_skb(skb);

			return -ENOMEM;

		}

		if (skb->sp)

			secpath_put(skb->sp);

		skb->sp = sp;

		skb->encapsulation = 1;



		sp->olen++;

		sp->xvec[skb->sp->len++] = x;

		sp->xvec[sp->len++] = x;

		xfrm_state_hold(x);



		if (skb_is_gso(skb)) {

CRA Git | Maintained and supported by SUSTech CRA and CCSE