5 files changed, 26 insertions, 9 deletions

diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index c34b4c82b0dc..20825e5f433f 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -425,6 +425,7 @@ enum
         NET_TCP_ALLOWED_CONG_CONTROL=123,
         NET_TCP_MAX_SSTHRESH=124,
         NET_TCP_FRTO_RESPONSE=125,
+        NET_IPV4_EARLY_DEMUX=126,
 };
 
 enum {
diff --git a/include/net/ip.h b/include/net/ip.h
index 83e0619f59d0..50841bd6f10e 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -210,6 +210,9 @@ extern int inet_peer_threshold;
 extern int inet_peer_minttl;
 extern int inet_peer_maxttl;
 
+/* From ip_input.c */
+extern int sysctl_ip_early_demux;
+
 /* From ip_output.c */
 extern int sysctl_ip_dynaddr;
 
diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
index a650694883a1..6a3cf8253aae 100644
--- a/kernel/sysctl_binary.c
+++ b/kernel/sysctl_binary.c
@@ -415,6 +415,8 @@ static const struct bin_table bin_net_ipv4_table[] = {
         { CTL_INT,      NET_IPV4_IPFRAG_SECRET_INTERVAL,        "ipfrag_secret_interval" },
         /* NET_IPV4_IPFRAG_MAX_DIST "ipfrag_max_dist" no longer used */
 
+        { CTL_INT,      NET_IPV4_EARLY_DEMUX,                   "ip_early_demux" },
+
         { CTL_INT,      2088 /* NET_IPQ_QMAX */,                "ip_queue_maxlen" },
 
         /* NET_TCP_DEFAULT_WIN_SCALE unused */
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 93b092c9a394..bca25179cdb9 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -313,6 +313,8 @@ drop:
         return true;
 }
 
+int sysctl_ip_early_demux __read_mostly = 1;
+
 static int ip_rcv_finish(struct sk_buff *skb)
 {
         const struct iphdr *iph = ip_hdr(skb);
@@ -323,16 +325,18 @@ static int ip_rcv_finish(struct sk_buff *skb)
          *      how the packet travels inside Linux networking.
          */
         if (skb_dst(skb) == NULL) {
-                const struct net_protocol *ipprot;
-                int protocol = iph->protocol;
-                int err;
+                int err = -ENOENT;
 
-                rcu_read_lock();
-                ipprot = rcu_dereference(inet_protos[protocol]);
-                err = -ENOENT;
-                if (ipprot && ipprot->early_demux)
-                        err = ipprot->early_demux(skb);
-                rcu_read_unlock();
+                if (sysctl_ip_early_demux) {
+                        const struct net_protocol *ipprot;
+                        int protocol = iph->protocol;
+
+                        rcu_read_lock();
+                        ipprot = rcu_dereference(inet_protos[protocol]);
+                        if (ipprot && ipprot->early_demux)
+                                err = ipprot->early_demux(skb);
+                        rcu_read_unlock();
+                }
 
                 if (err) {
                         err = ip_route_input_noref(skb, iph->daddr, iph->saddr,
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index ef32956ed655..12aa0c5867c4 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -301,6 +301,13 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
+                .procname       = "ip_early_demux",
+                .data           = &sysctl_ip_early_demux,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
                 .procname       = "ip_dynaddr",
                 .data           = &sysctl_ip_dynaddr,
                 .maxlen         = sizeof(int),