calipso_cache_add() stores calipso_ptr + 2 as the cache key, but computes entry->hash over calipso_ptr, i.e. starting two bytes earlier at the option type and length. calipso_opt_getattr() looks entries up with calipso_cache_check(calipso + 2, calipso[1], ...), which hashes the key itself. The two hashes only match on a jhash collision, so the CALIPSO label cache never hits and every labelled packet takes the full DOI lookup and category conversion path. The memcmp() on the key keeps lookups correct, so this is a performance bug only. Hash the stored key, as cipso_v4_cache_add() does for CIPSO. Fixes: 4fee5242bf41 ("calipso: Add a label cache.") Signed-off-by: Joas Antonio dos Santos Assisted-by: Claude:claude-opus-5-5 --- Found by code review. Compile-tested only (arm64, W=1); not runtime-tested. net/ipv6/calipso.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c index c072eca50..8c447d860 100644 --- a/net/ipv6/calipso.c +++ b/net/ipv6/calipso.c @@ -283,7 +283,7 @@ static int calipso_cache_add(const unsigned char *calipso_ptr, goto cache_add_failure; } entry->key_len = calipso_ptr_len; - entry->hash = calipso_map_cache_hash(calipso_ptr, calipso_ptr_len); + entry->hash = calipso_map_cache_hash(entry->key, calipso_ptr_len); refcount_inc(&secattr->cache->refcount); entry->lsm_data = secattr->cache;