From d538cc3ec0bc4cb7b40981b3213a6c6671959ed5 Mon Sep 17 00:00:00 2001 From: Joas Antonio dos Santos Date: Wed, 7 Oct 2026 12:25:00 -0300 Subject: [PATCH] calipso: hash the cache key, not the option start, in calipso_cache_add() calipso_cache_add() stores calipso_ptr + 2 as the cache key, but computes entry->hash over calipso_ptr, i.e. starting two bytes earlier at the option type and length. calipso_opt_getattr() looks entries up with calipso_cache_check(calipso + 2, calipso[1], ...), which hashes the key itself. The two hashes only match on a jhash collision, so the CALIPSO label cache never hits and every labelled packet takes the full DOI lookup and category conversion path. The memcmp() on the key keeps lookups correct, so this is a performance bug only. Hash the stored key, as cipso_v4_cache_add() does for CIPSO. Fixes: 4fee5242bf41 ("calipso: Add a label cache.") Signed-off-by: Joas Antonio dos Santos Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Daniel Machon Link: https://patch.msgid.link/179138670045.80227.16155454353416856947@gmail.com Signed-off-by: Paolo Abeni --- net/ipv6/calipso.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c index c6a34334e657..194772ed0cb9 100644 --- a/net/ipv6/calipso.c +++ b/net/ipv6/calipso.c @@ -283,7 +283,7 @@ static int calipso_cache_add(const unsigned char *calipso_ptr, goto cache_add_failure; } entry->key_len = calipso_ptr_len; - entry->hash = calipso_map_cache_hash(calipso_ptr, calipso_ptr_len); + entry->hash = calipso_map_cache_hash(entry->key, calipso_ptr_len); refcount_inc(&secattr->cache->refcount); entry->lsm_data = secattr->cache;