xfrm: prefer secpath_set over secpath_dup

secpath_set is a wrapper for secpath_dup that will not perform
an allocation if the secpath attached to the skb has a reference count
of one, i.e., it doesn't need to be COW'ed.

Also, secpath_dup doesn't attach the secpath to the skb, it leaves
this to the caller.

Use secpath_set in places that immediately assign the return value to
skb.

This allows to remove skb->sp without touching these spots again.

secpath_dup can eventually be removed in followup patch.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
index 8befc7a50f8c60ddf8afb6636d8d34cffab6cb4a..ff85ce5791a36a1d77eced727c0bd6df7d7634de 100644 (file)
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
@@ -1161,6 +1161,7 @@ void ixgbe_ipsec_rx(struct ixgbe_ring *rx_ring,
        struct xfrm_state *xs = NULL;
        struct ipv6hdr *ip6 = NULL;
        struct iphdr *ip4 = NULL;
+       struct sec_path *sp;
        void *daddr;
        __be32 spi;
        u8 *c_hdr;
@@ -1200,12 +1201,12 @@ void ixgbe_ipsec_rx(struct ixgbe_ring *rx_ring,
        if (unlikely(!xs))
                return;
 
-       skb->sp = secpath_dup(skb->sp);
-       if (unlikely(!skb->sp))
+       sp = secpath_set(skb);
+       if (unlikely(!sp))
                return;
 
-       skb->sp->xvec[skb->sp->len++] = xs;
-       skb->sp->olen++;
+       sp->xvec[sp->len++] = xs;
+       sp->olen++;
        xo = xfrm_offload(skb);
        xo->flags = CRYPTO_DONE;
        xo->status = CRYPTO_SUCCESS;

diff --git a/drivers/net/ethernet/intel/ixgbevf/ipsec.c b/drivers/net/ethernet/intel/ixgbevf/ipsec.c
index 07644e6bf498350e8697f67702225d874c3e729b..5170dd9d8705b0b6467151b9154e5f7b2ea8d78a 100644 (file)
--- a/drivers/net/ethernet/intel/ixgbevf/ipsec.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ipsec.c
@@ -548,6 +548,7 @@ void ixgbevf_ipsec_rx(struct ixgbevf_ring *rx_ring,
        struct xfrm_state *xs = NULL;
        struct ipv6hdr *ip6 = NULL;
        struct iphdr *ip4 = NULL;
+       struct sec_path *sp;
        void *daddr;
        __be32 spi;
        u8 *c_hdr;
@@ -587,12 +588,12 @@ void ixgbevf_ipsec_rx(struct ixgbevf_ring *rx_ring,
        if (unlikely(!xs))
                return;
 
-       skb->sp = secpath_dup(skb->sp);
-       if (unlikely(!skb->sp))
+       sp = secpath_set(skb);
+       if (unlikely(!sp))
                return;
 
-       skb->sp->xvec[skb->sp->len++] = xs;
-       skb->sp->olen++;
+       sp->xvec[sp->len++] = xs;
+       sp->olen++;
        xo = xfrm_offload(skb);
        xo->flags = CRYPTO_DONE;
        xo->status = CRYPTO_SUCCESS;

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c
index f6717c287ff4b84a5d3c147299187a0df59a19a5..53608afd39b6c4f1c27a873d9b3531047d4f6c12 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c
@@ -307,10 +307,11 @@ mlx5e_ipsec_build_sp(struct net_device *netdev, struct sk_buff *skb,
        struct mlx5e_priv *priv = netdev_priv(netdev);
        struct xfrm_offload *xo;
        struct xfrm_state *xs;
+       struct sec_path *sp;
        u32 sa_handle;
 
-       skb->sp = secpath_dup(skb->sp);
-       if (unlikely(!skb->sp)) {
+       sp = secpath_set(skb);
+       if (unlikely(!sp)) {
                atomic64_inc(&priv->ipsec->sw_stats.ipsec_rx_drop_sp_alloc);
                return NULL;
        }
@@ -322,8 +323,9 @@ mlx5e_ipsec_build_sp(struct net_device *netdev, struct sk_buff *skb,
                return NULL;
        }
 
-       skb->sp->xvec[skb->sp->len++] = xs;
-       skb->sp->olen++;
+       sp = skb_sec_path(skb);
+       sp->xvec[sp->len++] = xs;
+       sp->olen++;
 
        xo = xfrm_offload(skb);
        xo->flags = CRYPTO_DONE;

diff --git a/net/xfrm/Kconfig b/net/xfrm/Kconfig
index 140270a13d54f7c69584fa6aefbf6b1be0941ec6..5d43aaa1702738670b593edfe182437dfd5b1d3b 100644 (file)
--- a/net/xfrm/Kconfig
+++ b/net/xfrm/Kconfig
@@ -5,6 +5,7 @@ config XFRM
        bool
        depends on NET
        select GRO_CELLS
+       select SKB_EXTENSIONS
 
 config XFRM_OFFLOAD
        bool

diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 4ae87c5ce2e357b420aaa102bdbb416e7039f90a..757c4d11983b7803ee90acd8fe1550101f6445af 100644 (file)
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -218,19 +218,16 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb)
        if (xfrm_dev_offload_ok(skb, x)) {
                struct sec_path *sp;
 
-               sp = secpath_dup(skb->sp);
+               sp = secpath_set(skb);
                if (!sp) {
                        XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
                        kfree_skb(skb);
                        return -ENOMEM;
                }
-               if (skb->sp)
-                       secpath_put(skb->sp);
-               skb->sp = sp;
                skb->encapsulation = 1;
 
                sp->olen++;
-               sp->xvec[skb->sp->len++] = x;
+               sp->xvec[sp->len++] = x;
                xfrm_state_hold(x);
 
                if (skb_is_gso(skb)) {