pull request (net-next): ipsec-next 2016-09-23

pull request (net-next): ipsec-next 2016-09-23

[Steffen Klassert]

Only two patches this time:

1) Fix a comment reference to struct xfrm_replay_state_esn.
   From Richard Guy Briggs.

2) Convert xfrm_state_lookup to rcu, we don't need the
   xfrm_state_lock anymore in the input path.
   From Florian Westphal.

Please pull or let me know if there are problems.

Thanks!

The following changes since commit 2d2be8cab26ed918e94d2deae89580003242a123:

  bpf: fix range propagation on direct packet access (2016-09-08 17:28:37 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git master

for you to fetch changes up to c2f672fc94642bae96821a393f342edcfa9794a6:

  xfrm: state lookup can be lockless (2016-09-21 12:37:29 +0200)

----------------------------------------------------------------
Florian Westphal (1):
      xfrm: state lookup can be lockless

Richard Guy Briggs (1):
      xfrm: fix header file comment reference to struct xfrm_replay_state_esn

 include/uapi/linux/xfrm.h | 2 +-
 net/xfrm/xfrm_state.c     | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

[PATCH 1/2] xfrm: fix header file comment reference to struct xfrm_replay_state_esn

[Steffen Klassert]

From: Richard Guy Briggs <rgb@tricolour.ca>

Reported-by: Paul Wouters <paul@nohats.ca>
Signed-off-by: Richard Guy Briggs <rgb@tricolour.ca>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
 include/uapi/linux/xfrm.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/uapi/linux/xfrm.h b/include/uapi/linux/xfrm.h
index 1433389..1fc62b2 100644
--- a/include/uapi/linux/xfrm.h
+++ b/include/uapi/linux/xfrm.h
@@ -298,7 +298,7 @@ enum xfrm_attr_type_t {
 	XFRMA_ALG_AUTH_TRUNC,	/* struct xfrm_algo_auth */
 	XFRMA_MARK,		/* struct xfrm_mark */
 	XFRMA_TFCPAD,		/* __u32 */
-	XFRMA_REPLAY_ESN_VAL,	/* struct xfrm_replay_esn */
+	XFRMA_REPLAY_ESN_VAL,	/* struct xfrm_replay_state_esn */
 	XFRMA_SA_EXTRA_FLAGS,	/* __u32 */
 	XFRMA_PROTO,		/* __u8 */
 	XFRMA_ADDRESS_FILTER,	/* struct xfrm_address_filter */
-- 
1.9.1

[PATCH 2/2] xfrm: state lookup can be lockless

[Steffen Klassert]

From: Florian Westphal <fw@strlen.de>

This is called from the packet input path, we get lock contention
if many cpus handle ipsec in parallel.

After recent rcu conversion it is safe to call __xfrm_state_lookup
without the spinlock.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
 net/xfrm/xfrm_state.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index ba8bf51..a38fdea 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1431,9 +1431,9 @@ xfrm_state_lookup(struct net *net, u32 mark, const xfrm_address_t *daddr, __be32
 {
 	struct xfrm_state *x;
 
-	spin_lock_bh(&net->xfrm.xfrm_state_lock);
+	rcu_read_lock();
 	x = __xfrm_state_lookup(net, mark, daddr, spi, proto, family);
-	spin_unlock_bh(&net->xfrm.xfrm_state_lock);
+	rcu_read_unlock();
 	return x;
 }
 EXPORT_SYMBOL(xfrm_state_lookup);
-- 
1.9.1

Re: pull request (net-next): ipsec-next 2016-09-23

[David Miller]

From: Steffen Klassert <steffen.klassert@secunet.com>
Date: Fri, 23 Sep 2016 09:14:40 +0200

> Only two patches this time:
> 
> 1) Fix a comment reference to struct xfrm_replay_state_esn.
>    From Richard Guy Briggs.
> 
> 2) Convert xfrm_state_lookup to rcu, we don't need the
>    xfrm_state_lock anymore in the input path.
>    From Florian Westphal.
> 
> Please pull or let me know if there are problems.

Pulled, thanks Steffen.