Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dcebd315 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: add and use jump label for xt_tee 



Don't bother testing if we need to switch to alternate stack
unless TEE target is used.

Suggested-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 7814b6ec

include/linux/netfilter/x_tables.h

+7 −0
Original line number Diff line number Diff line
@@ -3,6 +3,7 @@ 




#include <linux/netdevice.h>

#include <linux/static_key.h>

#include <uapi/linux/netfilter/x_tables.h>



/**
@@ -280,6 +281,12 @@ void xt_free_table_info(struct xt_table_info *info); 
 */

DECLARE_PER_CPU(seqcount_t, xt_recseq);



/* xt_tee_enabled - true if x_tables needs to handle reentrancy

 *

 * Enabled if current ip(6)tables ruleset has at least one -j TEE rule.

 */

extern struct static_key xt_tee_enabled;



/**

 * xt_write_recseq_begin - start of a write section

 *

net/ipv4/netfilter/ip_tables.c

+2 −1
Original line number Diff line number Diff line
@@ -340,6 +340,7 @@ ipt_do_table(struct sk_buff *skb, 
	 * For recursion via REJECT or SYNPROXY the stack will be clobbered

	 * but it is no problem since absolute verdict is issued by these.

	 */

	if (static_key_false(&xt_tee_enabled))

		jumpstack += private->stacksize * __this_cpu_read(nf_skb_duplicated);



	e = get_entry(table_base, private->hook_entry[hook]);

net/ipv6/netfilter/ip6_tables.c

+2 −1
Original line number Diff line number Diff line
@@ -366,6 +366,7 @@ ip6t_do_table(struct sk_buff *skb, 
	 * For recursion via REJECT or SYNPROXY the stack will be clobbered

	 * but it is no problem since absolute verdict is issued by these.

	 */

	if (static_key_false(&xt_tee_enabled))

		jumpstack += private->stacksize * __this_cpu_read(nf_skb_duplicated);



	e = get_entry(table_base, private->hook_entry[hook]);

net/netfilter/x_tables.c

+3 −0
Original line number Diff line number Diff line
@@ -727,6 +727,9 @@ EXPORT_SYMBOL_GPL(xt_compat_unlock); 
DEFINE_PER_CPU(seqcount_t, xt_recseq);

EXPORT_PER_CPU_SYMBOL_GPL(xt_recseq);



struct static_key xt_tee_enabled __read_mostly;

EXPORT_SYMBOL_GPL(xt_tee_enabled);



static int xt_jumpstack_alloc(struct xt_table_info *i)

{

	unsigned int size;

net/netfilter/xt_TEE.c

+2 −0
Original line number Diff line number Diff line
@@ -251,6 +251,7 @@ static int tee_tg_check(const struct xt_tgchk_param *par) 
	} else

		info->priv = NULL;



	static_key_slow_inc(&xt_tee_enabled);

	return 0;

}
@@ -262,6 +263,7 @@ static void tee_tg_destroy(const struct xt_tgdtor_param *par) 
		unregister_netdevice_notifier(&info->priv->notifier);

		kfree(info->priv);

	}

	static_key_slow_dec(&xt_tee_enabled);

}



static struct xt_target tee_tg_reg[] __read_mostly = {