From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 19/22] bridge: reduce size of input cb to 16 bytes
Date: Mon, 15 Apr 2019 19:00:25 +0200 [thread overview]
Message-ID: <20190415170028.3470-20-pablo@netfilter.org> (raw)
In-Reply-To: <20190415170028.3470-1-pablo@netfilter.org>
From: Florian Westphal <fw@strlen.de>
Reduce size of br_input_skb_cb from 24 to 16 bytes by
using bitfield for those values that can only be 0 or 1.
igmp is the igmp type value, so it needs to be at least u8.
Furthermore, the bridge currently relies on step-by-step initialization
of br_input_skb_cb fields as the skb passes through the stack.
Explicitly zero out the bridge input cb instead, this avoids having to
review/validate that no BR_INPUT_SKB_CB(skb)->foo test can see a
'random' value from previous protocol cb.
AFAICS all current fields are always set up before they are read again,
so this is not a bug fix.
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: David S. Miller <davem@davemloft.net>
Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/bridge/br_arp_nd_proxy.c | 18 +++++++++---------
net/bridge/br_input.c | 2 ++
net/bridge/br_private.h | 12 +++++-------
3 files changed, 16 insertions(+), 16 deletions(-)
diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c
index 724b474ade54..15116752365a 100644
--- a/net/bridge/br_arp_nd_proxy.c
+++ b/net/bridge/br_arp_nd_proxy.c
@@ -131,7 +131,7 @@ void br_do_proxy_suppress_arp(struct sk_buff *skb, struct net_bridge *br,
u8 *arpptr, *sha;
__be32 sip, tip;
- BR_INPUT_SKB_CB(skb)->proxyarp_replied = false;
+ BR_INPUT_SKB_CB(skb)->proxyarp_replied = 0;
if ((dev->flags & IFF_NOARP) ||
!pskb_may_pull(skb, arp_hdr_len(dev)))
@@ -161,7 +161,7 @@ void br_do_proxy_suppress_arp(struct sk_buff *skb, struct net_bridge *br,
return;
if (ipv4_is_zeronet(sip) || sip == tip) {
/* prevent flooding to neigh suppress ports */
- BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
+ BR_INPUT_SKB_CB(skb)->proxyarp_replied = 1;
return;
}
}
@@ -181,7 +181,7 @@ void br_do_proxy_suppress_arp(struct sk_buff *skb, struct net_bridge *br,
/* its our local ip, so don't proxy reply
* and don't forward to neigh suppress ports
*/
- BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
+ BR_INPUT_SKB_CB(skb)->proxyarp_replied = 1;
return;
}
@@ -217,7 +217,7 @@ void br_do_proxy_suppress_arp(struct sk_buff *skb, struct net_bridge *br,
*/
if (replied ||
br_opt_get(br, BROPT_NEIGH_SUPPRESS_ENABLED))
- BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
+ BR_INPUT_SKB_CB(skb)->proxyarp_replied = 1;
}
neigh_release(n);
@@ -393,7 +393,7 @@ void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br,
struct ipv6hdr *iphdr;
struct neighbour *n;
- BR_INPUT_SKB_CB(skb)->proxyarp_replied = false;
+ BR_INPUT_SKB_CB(skb)->proxyarp_replied = 0;
if (p && (p->flags & BR_NEIGH_SUPPRESS))
return;
@@ -401,7 +401,7 @@ void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br,
if (msg->icmph.icmp6_type == NDISC_NEIGHBOUR_ADVERTISEMENT &&
!msg->icmph.icmp6_solicited) {
/* prevent flooding to neigh suppress ports */
- BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
+ BR_INPUT_SKB_CB(skb)->proxyarp_replied = 1;
return;
}
@@ -414,7 +414,7 @@ void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br,
if (ipv6_addr_any(saddr) || !ipv6_addr_cmp(saddr, daddr)) {
/* prevent flooding to neigh suppress ports */
- BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
+ BR_INPUT_SKB_CB(skb)->proxyarp_replied = 1;
return;
}
@@ -432,7 +432,7 @@ void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br,
/* its our own ip, so don't proxy reply
* and don't forward to arp suppress ports
*/
- BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
+ BR_INPUT_SKB_CB(skb)->proxyarp_replied = 1;
return;
}
@@ -465,7 +465,7 @@ void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br,
*/
if (replied ||
br_opt_get(br, BROPT_NEIGH_SUPPRESS_ENABLED))
- BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
+ BR_INPUT_SKB_CB(skb)->proxyarp_replied = 1;
}
neigh_release(n);
}
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 5ea7e56119c1..e2f93e5c72da 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -227,6 +227,8 @@ rx_handler_result_t br_handle_frame(struct sk_buff **pskb)
if (!skb)
return RX_HANDLER_CONSUMED;
+ memset(skb->cb, 0, sizeof(struct br_input_skb_cb));
+
p = br_port_get_rcu(skb->dev);
if (p->flags & BR_VLAN_TUNNEL) {
if (br_handle_ingress_vlan_tunnel(skb, p,
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 7946aa3b6e09..e7110a6e2b7e 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -425,15 +425,13 @@ struct br_input_skb_cb {
struct net_device *brdev;
#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
- int igmp;
- int mrouters_only;
+ u8 igmp;
+ u8 mrouters_only:1;
#endif
-
- bool proxyarp_replied;
- bool src_port_isolated;
-
+ u8 proxyarp_replied:1;
+ u8 src_port_isolated:1;
#ifdef CONFIG_BRIDGE_VLAN_FILTERING
- bool vlan_filtered;
+ u8 vlan_filtered:1;
#endif
#ifdef CONFIG_NET_SWITCHDEV
--
2.11.0
next prev parent reply other threads:[~2019-04-15 17:01 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-15 17:00 [PATCH 00/22] Netfilter/IPVS updates for net-next Pablo Neira Ayuso
2019-04-15 17:00 ` [PATCH 01/22] time: Introduce jiffies64_to_msecs() Pablo Neira Ayuso
2019-04-15 17:00 ` [PATCH 02/22] netfilter: nf_tables: remove unused parameter ctx Pablo Neira Ayuso
2019-04-15 17:00 ` [PATCH 03/22] netfilter: nft_redir: Make nft_redir_dump static Pablo Neira Ayuso
2019-04-15 17:00 ` [PATCH 04/22] netfilter: nf_flowtable: skip device lookup from interface index Pablo Neira Ayuso
2019-04-15 17:00 ` [PATCH 05/22] ipvs: allow tunneling with gue encapsulation Pablo Neira Ayuso
2019-04-15 17:00 ` [PATCH 06/22] netfilter: optimize nf_inet_addr_cmp Pablo Neira Ayuso
2019-04-15 17:00 ` [PATCH 07/22] netfilter: nat: add inet family nat support Pablo Neira Ayuso
2019-04-15 17:00 ` [PATCH 08/22] netfilter: nf_tables: merge route type into core Pablo Neira Ayuso
2019-04-15 17:00 ` [PATCH 09/22] netfilter: replace NF_NAT_NEEDED with IS_ENABLED(CONFIG_NF_NAT) Pablo Neira Ayuso
2019-04-15 17:00 ` [PATCH 10/22] netfilter: nft_masq: add inet support Pablo Neira Ayuso
2019-04-15 17:00 ` [PATCH 11/22] netfilter: nft_redir: " Pablo Neira Ayuso
2019-04-15 17:00 ` [PATCH 12/22] kselftests: extend nft_nat with inet family based nat hooks Pablo Neira Ayuso
2019-04-15 17:00 ` [PATCH 13/22] netfilter: nft_osf: Add version option support Pablo Neira Ayuso
2019-04-15 17:00 ` [PATCH 14/22] netfilter: make two functions static Pablo Neira Ayuso
2019-04-15 17:00 ` [PATCH 15/22] netfilter: nf_nat: merge ip/ip6 masquerade headers Pablo Neira Ayuso
2019-04-15 17:00 ` [PATCH 16/22] netfilter: x_tables: merge ip and ipv6 masquerade modules Pablo Neira Ayuso
2019-04-15 17:00 ` [PATCH 17/22] netfilter: nf_nat_masquerade: unify ipv4/6 notifier registration Pablo Neira Ayuso
2019-04-15 17:00 ` [PATCH 18/22] selftests: netfilter: add ebtables broute test case Pablo Neira Ayuso
2019-04-15 17:00 ` Pablo Neira Ayuso [this message]
2019-04-15 17:00 ` [PATCH 20/22] bridge: netfilter: unroll NF_HOOK helper in bridge input path Pablo Neira Ayuso
2019-04-15 17:00 ` [PATCH 21/22] bridge: broute: make broute a real ebtables table Pablo Neira Ayuso
2019-04-15 17:00 ` [PATCH 22/22] bridge: only include nf_queue.h if needed Pablo Neira Ayuso
2019-04-15 19:14 ` [PATCH 00/22] Netfilter/IPVS updates for net-next David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190415170028.3470-20-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).