This is a note to let you know that I've just added the patch titled
tcp: Don't flag tcp_sk(sk)->rx_opt.saw_unknown for TCP AO.
to the 6.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
tcp-don-t-flag-tcp_sk-sk-rx_opt.saw_unknown-for-tcp-.patch
and it can be found in the queue-6.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit 9261800398d0d019e1665d789d6b1007b20ebcfa
Author: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
Date: Tue Jul 2 20:35:08 2024 -0700
tcp: Don't flag tcp_sk(sk)->rx_opt.saw_unknown for TCP AO.
[ Upstream commit 4b74726c01b7a0b5e1029e1e9247fd81590da726 ]
When we process segments with TCP AO, we don't check it in
tcp_parse_options(). Thus, opt_rx->saw_unknown is set to 1,
which unconditionally triggers the BPF TCP option parser.
Let's avoid the unnecessary BPF invocation.
Fixes: 0a3a809089eb ("net/tcp: Verify inbound TCP-AO signed segments")
Signed-off-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>
Acked-by: Dmitry Safonov <0x7f454c46@xxxxxxxxx>
Link: https://patch.msgid.link/20240703033508.6321-1-kuniyu@xxxxxxxxxx
Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 77109976fe836..7b692bcb61d4a 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4220,6 +4220,13 @@ void tcp_parse_options(const struct net *net,
* checked (see tcp_v{4,6}_rcv()).
*/
break;
+#endif
+#ifdef CONFIG_TCP_AO
+ case TCPOPT_AO:
+ /* TCP AO has already been checked
+ * (see tcp_inbound_ao_hash()).
+ */
+ break;
#endif
case TCPOPT_FASTOPEN:
tcp_parse_fastopen_option(
