6.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
[ Upstream commit 4b74726c01b7a0b5e1029e1e9247fd81590da726 ]
When we process segments with TCP AO, we don't check it in
tcp_parse_options(). Thus, opt_rx->saw_unknown is set to 1,
which unconditionally triggers the BPF TCP option parser.
Let's avoid the unnecessary BPF invocation.
Fixes: 0a3a809089eb ("net/tcp: Verify inbound TCP-AO signed segments")
Signed-off-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>
Acked-by: Dmitry Safonov <0x7f454c46@xxxxxxxxx>
Link: https://patch.msgid.link/20240703033508.6321-1-kuniyu@xxxxxxxxxx
Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
---
net/ipv4/tcp_input.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 77109976fe836..7b692bcb61d4a 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4220,6 +4220,13 @@ void tcp_parse_options(const struct net *net,
* checked (see tcp_v{4,6}_rcv()).
*/
break;
+#endif
+#ifdef CONFIG_TCP_AO
+ case TCPOPT_AO:
+ /* TCP AO has already been checked
+ * (see tcp_inbound_ao_hash()).
+ */
+ break;
#endif
case TCPOPT_FASTOPEN:
tcp_parse_fastopen_option(
--
2.43.0
