cipso: don't use IPCB() to locate the CIPSO IP option
authorPaul Moore <pmoore@redhat.com>
Wed, 11 Feb 2015 19:46:37 +0000 (14:46 -0500)
committerPaul Moore <pmoore@redhat.com>
Wed, 11 Feb 2015 19:46:37 +0000 (14:46 -0500)
commit04f81f0154e4bf002be6f4d85668ce1257efa4d9
tree6572c58a65fe65aa738419e43e45e59c32538357
parent6eb4e2b41b264f57ee02d16ee61683952945484d
cipso: don't use IPCB() to locate the CIPSO IP option

Using the IPCB() macro to get the IPv4 options is convenient, but
unfortunately NetLabel often needs to examine the CIPSO option outside
of the scope of the IP layer in the stack.  While historically IPCB()
worked above the IP layer, due to the inclusion of the inet_skb_param
struct at the head of the {tcp,udp}_skb_cb structs, recent commit
971f10ec ("tcp: better TCP_SKB_CB layout to reduce cache line misses")
reordered the tcp_skb_cb struct and invalidated this IPCB() trick.

This patch fixes the problem by creating a new function,
cipso_v4_optptr(), which locates the CIPSO option inside the IP header
without calling IPCB().  Unfortunately, this isn't as fast as a simple
lookup so some additional tweaks were made to limit the use of this
new function.

Cc: <stable@vger.kernel.org> # 3.18
Reported-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Paul Moore <pmoore@redhat.com>
Tested-by: Casey Schaufler <casey@schaufler-ca.com>
include/net/cipso_ipv4.h
net/ipv4/cipso_ipv4.c
net/netlabel/netlabel_kapi.c