pull request (net-next): ipsec-next 2018-10-18

pull request (net-next): ipsec-next 2018-10-18

[Steffen Klassert]

1) Remove an unnecessary dev->tstats check in xfrmi_get_stats64.
   From Li RongQing.

2) We currently do a sizeof(element) instead of a sizeof(array)
   check when initializing the ovec array of the secpath.
   Currently this array can have only one element, so code is
   OK but error-prone. Change this to do a sizeof(array)
   check so that we can add more elements in future.
   From Li RongQing.

3) Improve xfrm IPv6 address hashing by using the complete IPv6
   addresses for a hash. From Michal Kubecek.

Please pull or let me know if there are problems.

Thanks!

The following changes since commit abf1a08ff3237a27188ff8cc2904f2cea893af55:

  net: vhost: remove bad code line (2018-10-07 21:31:32 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git master

for you to fetch changes up to 8d4b6bce2559755cf2db6513a267fccdfbf7c3ab:

  xfrm: use complete IPv6 addresses for hash (2018-10-15 10:09:18 +0200)

----------------------------------------------------------------
Li RongQing (2):
      xfrm: remove unnecessary check in xfrmi_get_stats64
      xfrm: use correct size to initialise sp->ovec

Michal Kubecek (1):
      xfrm: use complete IPv6 addresses for hash

 net/xfrm/xfrm_hash.h      | 5 ++---
 net/xfrm/xfrm_input.c     | 2 +-
 net/xfrm/xfrm_interface.c | 3 ---
 3 files changed, 3 insertions(+), 7 deletions(-)

[PATCH 1/3] xfrm: remove unnecessary check in xfrmi_get_stats64

[Steffen Klassert]

From: Li RongQing <lirongqing@baidu.com>

if tstats of a device is not allocated, this device is not
registered correctly and can not be used.

Signed-off-by: Li RongQing <lirongqing@baidu.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
 net/xfrm/xfrm_interface.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
index dc5b20bf29cf..abafd49cc65d 100644
--- a/net/xfrm/xfrm_interface.c
+++ b/net/xfrm/xfrm_interface.c
@@ -561,9 +561,6 @@ static void xfrmi_get_stats64(struct net_device *dev,
 {
 	int cpu;
 
-	if (!dev->tstats)
-		return;
-
 	for_each_possible_cpu(cpu) {
 		struct pcpu_sw_netstats *stats;
 		struct pcpu_sw_netstats tmp;
-- 
2.17.1

[PATCH 2/3] xfrm: use correct size to initialise sp->ovec

[Steffen Klassert]

From: Li RongQing <lirongqing@baidu.com>

This place should want to initialize array, not a element,
so it should be sizeof(array) instead of sizeof(element)

but now this array only has one element, so no error in
this condition that XFRM_MAX_OFFLOAD_DEPTH is 1

Signed-off-by: Li RongQing <lirongqing@baidu.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
 net/xfrm/xfrm_input.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index be3520e429c9..684c0bc01e2c 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -131,7 +131,7 @@ struct sec_path *secpath_dup(struct sec_path *src)
 	sp->len = 0;
 	sp->olen = 0;
 
-	memset(sp->ovec, 0, sizeof(sp->ovec[XFRM_MAX_OFFLOAD_DEPTH]));
+	memset(sp->ovec, 0, sizeof(sp->ovec));
 
 	if (src) {
 		int i;
-- 
2.17.1

[PATCH 3/3] xfrm: use complete IPv6 addresses for hash

[Steffen Klassert]

From: Michal Kubecek <mkubecek@suse.cz>

In some environments it is common that many hosts share the same lower half
of their IPv6 addresses (in particular ::1). As __xfrm6_addr_hash() and
__xfrm6_daddr_saddr_hash() calculate the hash only from the lower halves,
as much as 1/3 of the hosts ends up in one hashtable chain which harms the
performance.

Use complete IPv6 addresses when calculating the hashes. Rather than just
adding two more words to the xor, use jhash2() for consistency with
__xfrm6_pref_hash() and __xfrm6_dpref_spref_hash().

Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
 net/xfrm/xfrm_hash.h | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/net/xfrm/xfrm_hash.h b/net/xfrm/xfrm_hash.h
index 61be810389d8..ce66323102f9 100644
--- a/net/xfrm/xfrm_hash.h
+++ b/net/xfrm/xfrm_hash.h
@@ -13,7 +13,7 @@ static inline unsigned int __xfrm4_addr_hash(const xfrm_address_t *addr)
 
 static inline unsigned int __xfrm6_addr_hash(const xfrm_address_t *addr)
 {
-	return ntohl(addr->a6[2] ^ addr->a6[3]);
+	return jhash2((__force u32 *)addr->a6, 4, 0);
 }
 
 static inline unsigned int __xfrm4_daddr_saddr_hash(const xfrm_address_t *daddr,
@@ -26,8 +26,7 @@ static inline unsigned int __xfrm4_daddr_saddr_hash(const xfrm_address_t *daddr,
 static inline unsigned int __xfrm6_daddr_saddr_hash(const xfrm_address_t *daddr,
 						    const xfrm_address_t *saddr)
 {
-	return ntohl(daddr->a6[2] ^ daddr->a6[3] ^
-		     saddr->a6[2] ^ saddr->a6[3]);
+	return __xfrm6_addr_hash(daddr) ^ __xfrm6_addr_hash(saddr);
 }
 
 static inline u32 __bits2mask32(__u8 bits)
-- 
2.17.1

Re: pull request (net-next): ipsec-next 2018-10-18

[David Miller]

From: Steffen Klassert <steffen.klassert@secunet.com>
Date: Thu, 18 Oct 2018 12:56:51 +0200

> 1) Remove an unnecessary dev->tstats check in xfrmi_get_stats64.
>    From Li RongQing.
> 
> 2) We currently do a sizeof(element) instead of a sizeof(array)
>    check when initializing the ovec array of the secpath.
>    Currently this array can have only one element, so code is
>    OK but error-prone. Change this to do a sizeof(array)
>    check so that we can add more elements in future.
>    From Li RongQing.
> 
> 3) Improve xfrm IPv6 address hashing by using the complete IPv6
>    addresses for a hash. From Michal Kubecek.
> 
> Please pull or let me know if there are problems.

Also pulled, thank you.