Commit 790eb673 authored by Eric Dumazet's avatar Eric Dumazet Committed by Jakub Kicinski
Browse files

ipv6: guard IPV6_MINHOPCOUNT with a static key 



RFC 5082 IPV6_MINHOPCOUNT is rarely used on hosts.

Add a static key to remove from TCP fast path useless code,
and potential cache line miss to fetch tcp_inet6_sk(sk)->min_hopcount

Note that once ip6_min_hopcount static key has been enabled,
it stays enabled until next boot.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Acked-by: default avatarSoheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent cc17c3c8

include/net/ipv6.h

+1 −0
Original line number Diff line number Diff line
@@ -1092,6 +1092,7 @@ struct in6_addr *fl6_update_dst(struct flowi6 *fl6, 
/*

 *	socket options (ipv6_sockglue.c)

 */

DECLARE_STATIC_KEY_FALSE(ip6_min_hopcount);



int ipv6_setsockopt(struct sock *sk, int level, int optname, sockptr_t optval,

		    unsigned int optlen);

net/ipv6/ipv6_sockglue.c

+6 −0
Original line number Diff line number Diff line
@@ -55,6 +55,8 @@ 
struct ip6_ra_chain *ip6_ra_chain;

DEFINE_RWLOCK(ip6_ra_lock);



DEFINE_STATIC_KEY_FALSE(ip6_min_hopcount);



int ip6_ra_control(struct sock *sk, int sel)

{

	struct ip6_ra_chain *ra, *new_ra, **rap;
@@ -950,6 +952,10 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, 
			goto e_inval;

		if (val < 0 || val > 255)

			goto e_inval;



		if (val)

			static_branch_enable(&ip6_min_hopcount);



		/* tcp_v6_err() and tcp_v6_rcv() might read min_hopcount

		 * while we are changing it.

		 */

net/ipv6/tcp_ipv6.c

+13 −8
Original line number Diff line number Diff line
@@ -414,11 +414,13 @@ static int tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, 
	if (sk->sk_state == TCP_CLOSE)

		goto out;



	if (static_branch_unlikely(&ip6_min_hopcount)) {

		/* min_hopcount can be changed concurrently from do_ipv6_setsockopt() */

		if (ipv6_hdr(skb)->hop_limit < READ_ONCE(tcp_inet6_sk(sk)->min_hopcount)) {

			__NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);

			goto out;

		}

	}



	tp = tcp_sk(sk);

	/* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
@@ -1727,11 +1729,14 @@ INDIRECT_CALLABLE_SCOPE int tcp_v6_rcv(struct sk_buff *skb) 
			return 0;

		}

	}



	if (static_branch_unlikely(&ip6_min_hopcount)) {

		/* min_hopcount can be changed concurrently from do_ipv6_setsockopt() */

		if (hdr->hop_limit < READ_ONCE(tcp_inet6_sk(sk)->min_hopcount)) {

			__NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);

			goto discard_and_relse;

		}

	}



	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))

		goto discard_and_relse;