mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-30 06:10:56 +00:00
netfilter: nf_tables: defer gc run if previous batch is still pending
commit8e51830e29
upstream. Don't queue more gc work, else we may queue the same elements multiple times. If an element is flagged as dead, this can mean that either the previous gc request was invalidated/discarded by a transaction or that the previous request is still pending in the system work queue. The latter will happen if the gc interval is set to a very low value, e.g. 1ms, and system work queue is backlogged. The sets refcount is 1 if no previous gc requeusts are queued, so add a helper for this and skip gc run if old requests are pending. Add a helper for this and skip the gc run in this case. Fixes:f6c383b8c3
("netfilter: nf_tables: adapt set backend to use GC transaction API") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
082791b421
commit
9366966caf
3 changed files with 11 additions and 0 deletions
|
@ -551,6 +551,11 @@ static inline void *nft_set_priv(const struct nft_set *set)
|
|||
return (void *)set->data;
|
||||
}
|
||||
|
||||
static inline bool nft_set_gc_is_pending(const struct nft_set *s)
|
||||
{
|
||||
return refcount_read(&s->refs) != 1;
|
||||
}
|
||||
|
||||
static inline struct nft_set *nft_set_container_of(const void *priv)
|
||||
{
|
||||
return (void *)priv - offsetof(struct nft_set, data);
|
||||
|
|
|
@ -326,6 +326,9 @@ static void nft_rhash_gc(struct work_struct *work)
|
|||
nft_net = nft_pernet(net);
|
||||
gc_seq = READ_ONCE(nft_net->gc_seq);
|
||||
|
||||
if (nft_set_gc_is_pending(set))
|
||||
goto done;
|
||||
|
||||
gc = nft_trans_gc_alloc(set, gc_seq, GFP_KERNEL);
|
||||
if (!gc)
|
||||
goto done;
|
||||
|
|
|
@ -611,6 +611,9 @@ static void nft_rbtree_gc(struct work_struct *work)
|
|||
nft_net = nft_pernet(net);
|
||||
gc_seq = READ_ONCE(nft_net->gc_seq);
|
||||
|
||||
if (nft_set_gc_is_pending(set))
|
||||
goto done;
|
||||
|
||||
gc = nft_trans_gc_alloc(set, gc_seq, GFP_KERNEL);
|
||||
if (!gc)
|
||||
goto done;
|
||||
|
|
Loading…
Reference in a new issue