netfilter: xtables: change hotdrop pointer to direct modification

Since xt_action_param is writable, let's use it. The pointer to
'bool hotdrop' always worried (8 bytes (64-bit) to write 1 byte!).
Surprisingly results in a reduction in size:

   text    data     bss filename
5457066  692730  357892 vmlinux.o-prev
5456554  692730  357892 vmlinux.o

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

7 files changed, 16 insertions, 17 deletions

diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 4549f8d6f88f..557fac9689c0 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -337,7 +337,6 @@ ip6t_do_table(struct sk_buff *skb,
               struct xt_table *table)
 {
         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
-        bool hotdrop = false;
         /* Initializing verdict to NF_DROP keeps gcc happy. */
         unsigned int verdict = NF_DROP;
         const char *indev, *outdev;
@@ -356,7 +355,7 @@ ip6t_do_table(struct sk_buff *skb,
          * things we don't know, ie. tcp syn flag or ports).  If the
          * rule is also a fragment-specific rule, non-fragments won't
          * match it. */
-        acpar.hotdrop = &hotdrop;
+        acpar.hotdrop = false;
         acpar.in      = in;
         acpar.out     = out;
         acpar.family  = NFPROTO_IPV6;
@@ -380,7 +379,7 @@ ip6t_do_table(struct sk_buff *skb,
 
                 IP_NF_ASSERT(e);
                 if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
-                    &acpar.thoff, &acpar.fragoff, &hotdrop)) {
+                    &acpar.thoff, &acpar.fragoff, &acpar.hotdrop)) {
  no_match:
                         e = ip6t_next_entry(e);
                         continue;
@@ -447,7 +446,7 @@ ip6t_do_table(struct sk_buff *skb,
                 else
                         /* Verdict */
                         break;
-        } while (!hotdrop);
+        } while (!acpar.hotdrop);
 
         xt_info_rdunlock_bh();
         *stackptr = origptr;
@@ -455,7 +454,7 @@ ip6t_do_table(struct sk_buff *skb,
 #ifdef DEBUG_ALLOW_ALL
         return NF_ACCEPT;
 #else
-        if (hotdrop)
+        if (acpar.hotdrop)
                 return NF_DROP;
         else return verdict;
 #endif
@@ -2170,7 +2169,7 @@ icmp6_match(const struct sk_buff *skb, struct xt_action_param *par)
                  * can't.  Hence, no choice but to drop.
                  */
                 duprintf("Dropping evil ICMP tinygram.\n");
-                *par->hotdrop = true;
+                par->hotdrop = true;
                 return false;
         }
 
diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index c89887f35a46..89cccc5a9c92 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -48,13 +48,13 @@ static bool ah_mt6(const struct sk_buff *skb, struct xt_action_param *par)
         err = ipv6_find_hdr(skb, &ptr, NEXTHDR_AUTH, NULL);
         if (err < 0) {
                 if (err != -ENOENT)
-                        *par->hotdrop = true;
+                        par->hotdrop = true;
                 return false;
         }
 
         ah = skb_header_pointer(skb, ptr, sizeof(_ah), &_ah);
         if (ah == NULL) {
-                *par->hotdrop = true;
+                par->hotdrop = true;
                 return false;
         }
 
diff --git a/net/ipv6/netfilter/ip6t_eui64.c b/net/ipv6/netfilter/ip6t_eui64.c
index f32fce34145a..aab0706908c5 100644
--- a/net/ipv6/netfilter/ip6t_eui64.c
+++ b/net/ipv6/netfilter/ip6t_eui64.c
@@ -27,7 +27,7 @@ eui64_mt6(const struct sk_buff *skb, struct xt_action_param *par)
         if (!(skb_mac_header(skb) >= skb->head &&
               skb_mac_header(skb) + ETH_HLEN <= skb->data) &&
             par->fragoff != 0) {
-                *par->hotdrop = true;
+                par->hotdrop = true;
                 return false;
         }
 
diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c
index fcc8c72f218e..eda898fda6ca 100644
--- a/net/ipv6/netfilter/ip6t_frag.c
+++ b/net/ipv6/netfilter/ip6t_frag.c
@@ -46,13 +46,13 @@ frag_mt6(const struct sk_buff *skb, struct xt_action_param *par)
         err = ipv6_find_hdr(skb, &ptr, NEXTHDR_FRAGMENT, NULL);
         if (err < 0) {
                 if (err != -ENOENT)
-                        *par->hotdrop = true;
+                        par->hotdrop = true;
                 return false;
         }
 
         fh = skb_header_pointer(skb, ptr, sizeof(_frag), &_frag);
         if (fh == NULL) {
-                *par->hotdrop = true;
+                par->hotdrop = true;
                 return false;
         }
 
diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c
index f8aebc098d71..59df051eaef6 100644
--- a/net/ipv6/netfilter/ip6t_hbh.c
+++ b/net/ipv6/netfilter/ip6t_hbh.c
@@ -65,13 +65,13 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
                             NEXTHDR_HOP : NEXTHDR_DEST, NULL);
         if (err < 0) {
                 if (err != -ENOENT)
-                        *par->hotdrop = true;
+                        par->hotdrop = true;
                 return false;
         }
 
         oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);
         if (oh == NULL) {
-                *par->hotdrop = true;
+                par->hotdrop = true;
                 return false;
         }
 
diff --git a/net/ipv6/netfilter/ip6t_mh.c b/net/ipv6/netfilter/ip6t_mh.c
index eb1c3d65271a..0c90c66b1992 100644
--- a/net/ipv6/netfilter/ip6t_mh.c
+++ b/net/ipv6/netfilter/ip6t_mh.c
@@ -47,14 +47,14 @@ static bool mh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
                 /* We've been asked to examine this packet, and we
                    can't.  Hence, no choice but to drop. */
                 pr_debug("Dropping evil MH tinygram.\n");
-                *par->hotdrop = true;
+                par->hotdrop = true;
                 return false;
         }
 
         if (mh->ip6mh_proto != IPPROTO_NONE) {
                 pr_debug("Dropping invalid MH Payload Proto: %u\n",
                          mh->ip6mh_proto);
-                *par->hotdrop = true;
+                par->hotdrop = true;
                 return false;
         }
 
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index ee584693ee35..d8488c50a8e0 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -52,13 +52,13 @@ static bool rt_mt6(const struct sk_buff *skb, struct xt_action_param *par)
         err = ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL);
         if (err < 0) {
                 if (err != -ENOENT)
-                        *par->hotdrop = true;
+                        par->hotdrop = true;
                 return false;
         }
 
         rh = skb_header_pointer(skb, ptr, sizeof(_route), &_route);
         if (rh == NULL) {
-                *par->hotdrop = true;
+                par->hotdrop = true;
                 return false;
         }