mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-24 03:15:59 +00:00
netfilter: conntrack: fix calculation of next bucket number in early_drop
commitf393808dc6
upstream. If there's no entry to drop in bucket that corresponds to the hash, early_drop() should look for it in other buckets. But since it increments hash instead of bucket number, it actually looks in the same bucket 8 times: hsize is 16k by default (14 bits) and hash is 32-bit value, so reciprocal_scale(hash, hsize) returns the same value for hash..hash+7 in most cases. Fix it by increasing bucket number instead of hash and rename _hash to bucket to avoid future confusion. Fixes:3e86638e9a
("netfilter: conntrack: consider ct netns in early_drop logic") Cc: <stable@vger.kernel.org> # v4.7+ Signed-off-by: Vasily Khoruzhick <vasilykh@arista.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
ccd35ba5eb
commit
1be1576a13
1 changed files with 8 additions and 5 deletions
|
@ -1073,19 +1073,22 @@ static unsigned int early_drop_list(struct net *net,
|
||||||
return drops;
|
return drops;
|
||||||
}
|
}
|
||||||
|
|
||||||
static noinline int early_drop(struct net *net, unsigned int _hash)
|
static noinline int early_drop(struct net *net, unsigned int hash)
|
||||||
{
|
{
|
||||||
unsigned int i;
|
unsigned int i, bucket;
|
||||||
|
|
||||||
for (i = 0; i < NF_CT_EVICTION_RANGE; i++) {
|
for (i = 0; i < NF_CT_EVICTION_RANGE; i++) {
|
||||||
struct hlist_nulls_head *ct_hash;
|
struct hlist_nulls_head *ct_hash;
|
||||||
unsigned int hash, hsize, drops;
|
unsigned int hsize, drops;
|
||||||
|
|
||||||
rcu_read_lock();
|
rcu_read_lock();
|
||||||
nf_conntrack_get_ht(&ct_hash, &hsize);
|
nf_conntrack_get_ht(&ct_hash, &hsize);
|
||||||
hash = reciprocal_scale(_hash++, hsize);
|
if (!i)
|
||||||
|
bucket = reciprocal_scale(hash, hsize);
|
||||||
|
else
|
||||||
|
bucket = (bucket + 1) % hsize;
|
||||||
|
|
||||||
drops = early_drop_list(net, &ct_hash[hash]);
|
drops = early_drop_list(net, &ct_hash[bucket]);
|
||||||
rcu_read_unlock();
|
rcu_read_unlock();
|
||||||
|
|
||||||
if (drops) {
|
if (drops) {
|
||||||
|
|
Loading…
Reference in a new issue