* [PATCH 0/2] netfilter: netfilter fixes
@ 2010-05-31 16:14 kaber
2010-05-31 16:14 ` [PATCH 1/2] netfilter: don't xt_jumpstack_alloc twice in xt_register_table kaber
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: kaber @ 2010-05-31 16:14 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
the following two patches fix two problems with the recent introduction of
a seperately allocated jumpstack for xtables rulesets:
- a memory leak when registering new tables, from Xiaotian Feng
- performance degradation caused by not using per-CPU allocations
for the jumpstack, from Eric
Please apply or pull from:
git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6.git master
Thanks!
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 1/2] netfilter: don't xt_jumpstack_alloc twice in xt_register_table
2010-05-31 16:14 [PATCH 0/2] netfilter: netfilter fixes kaber
@ 2010-05-31 16:14 ` kaber
2010-05-31 16:14 ` [PATCH 2/2] netfilter: xtables: stackptr should be percpu kaber
2010-06-01 6:45 ` [PATCH 0/2] netfilter: netfilter fixes David Miller
2 siblings, 0 replies; 6+ messages in thread
From: kaber @ 2010-05-31 16:14 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
From: Xiaotian Feng <dfeng@redhat.com>
In xt_register_table, xt_jumpstack_alloc is called first, later
xt_replace_table is used. But in xt_replace_table, xt_jumpstack_alloc
will be used again. Then the memory allocated by previous xt_jumpstack_alloc
will be leaked. We can simply remove the previous xt_jumpstack_alloc because
there aren't any users of newinfo between xt_jumpstack_alloc and
xt_replace_table.
Signed-off-by: Xiaotian Feng <dfeng@redhat.com>
Cc: Patrick McHardy <kaber@trash.net>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jan Engelhardt <jengelh@medozas.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Acked-By: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
net/netfilter/x_tables.c | 4 ----
1 files changed, 0 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 445de70..47b1e79 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -844,10 +844,6 @@ struct xt_table *xt_register_table(struct net *net,
struct xt_table_info *private;
struct xt_table *t, *table;
- ret = xt_jumpstack_alloc(newinfo);
- if (ret < 0)
- return ERR_PTR(ret);
-
/* Don't add one object to multiple lists. */
table = kmemdup(input_table, sizeof(struct xt_table), GFP_KERNEL);
if (!table) {
--
1.7.0.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/2] netfilter: xtables: stackptr should be percpu
2010-05-31 16:14 [PATCH 0/2] netfilter: netfilter fixes kaber
2010-05-31 16:14 ` [PATCH 1/2] netfilter: don't xt_jumpstack_alloc twice in xt_register_table kaber
@ 2010-05-31 16:14 ` kaber
2010-06-01 6:45 ` [PATCH 0/2] netfilter: netfilter fixes David Miller
2 siblings, 0 replies; 6+ messages in thread
From: kaber @ 2010-05-31 16:14 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
From: Eric Dumazet <eric.dumazet@gmail.com>
commit f3c5c1bfd4 (netfilter: xtables: make ip_tables reentrant)
introduced a performance regression, because stackptr array is shared by
all cpus, adding cache line ping pongs. (16 cpus share a 64 bytes cache
line)
Fix this using alloc_percpu()
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Acked-By: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
include/linux/netfilter/x_tables.h | 2 +-
net/ipv4/netfilter/ip_tables.c | 2 +-
net/ipv6/netfilter/ip6_tables.c | 2 +-
net/netfilter/x_tables.c | 13 +++----------
4 files changed, 6 insertions(+), 13 deletions(-)
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index c00cc0c..24e5d01 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -397,7 +397,7 @@ struct xt_table_info {
* @stacksize jumps (number of user chains) can possibly be made.
*/
unsigned int stacksize;
- unsigned int *stackptr;
+ unsigned int __percpu *stackptr;
void ***jumpstack;
/* ipt_entry tables: one per CPU */
/* Note : this field MUST be the last one, see XT_TABLE_INFO_SZ */
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 63958f3..4b6c5ca 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -336,7 +336,7 @@ ipt_do_table(struct sk_buff *skb,
cpu = smp_processor_id();
table_base = private->entries[cpu];
jumpstack = (struct ipt_entry **)private->jumpstack[cpu];
- stackptr = &private->stackptr[cpu];
+ stackptr = per_cpu_ptr(private->stackptr, cpu);
origptr = *stackptr;
e = get_entry(table_base, private->hook_entry[hook]);
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 6f517bd..9d2d68f 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -363,7 +363,7 @@ ip6t_do_table(struct sk_buff *skb,
cpu = smp_processor_id();
table_base = private->entries[cpu];
jumpstack = (struct ip6t_entry **)private->jumpstack[cpu];
- stackptr = &private->stackptr[cpu];
+ stackptr = per_cpu_ptr(private->stackptr, cpu);
origptr = *stackptr;
e = get_entry(table_base, private->hook_entry[hook]);
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 47b1e79..e34622f 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -699,10 +699,8 @@ void xt_free_table_info(struct xt_table_info *info)
vfree(info->jumpstack);
else
kfree(info->jumpstack);
- if (sizeof(unsigned int) * nr_cpu_ids > PAGE_SIZE)
- vfree(info->stackptr);
- else
- kfree(info->stackptr);
+
+ free_percpu(info->stackptr);
kfree(info);
}
@@ -753,14 +751,9 @@ static int xt_jumpstack_alloc(struct xt_table_info *i)
unsigned int size;
int cpu;
- size = sizeof(unsigned int) * nr_cpu_ids;
- if (size > PAGE_SIZE)
- i->stackptr = vmalloc(size);
- else
- i->stackptr = kmalloc(size, GFP_KERNEL);
+ i->stackptr = alloc_percpu(unsigned int);
if (i->stackptr == NULL)
return -ENOMEM;
- memset(i->stackptr, 0, size);
size = sizeof(void **) * nr_cpu_ids;
if (size > PAGE_SIZE)
--
1.7.0.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 0/2] netfilter: netfilter fixes
2010-05-31 16:14 [PATCH 0/2] netfilter: netfilter fixes kaber
2010-05-31 16:14 ` [PATCH 1/2] netfilter: don't xt_jumpstack_alloc twice in xt_register_table kaber
2010-05-31 16:14 ` [PATCH 2/2] netfilter: xtables: stackptr should be percpu kaber
@ 2010-06-01 6:45 ` David Miller
2 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2010-06-01 6:45 UTC (permalink / raw)
To: kaber; +Cc: netfilter-devel, netdev
From: kaber@trash.net
Date: Mon, 31 May 2010 18:14:45 +0200
> the following two patches fix two problems with the recent introduction of
> a seperately allocated jumpstack for xtables rulesets:
>
> - a memory leak when registering new tables, from Xiaotian Feng
>
> - performance degradation caused by not using per-CPU allocations
> for the jumpstack, from Eric
>
> Please apply or pull from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6.git master
Pulled, thanks Patrick.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 0/2] netfilter: netfilter fixes
2010-11-12 15:19 kaber
@ 2010-11-12 19:07 ` David Miller
0 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2010-11-12 19:07 UTC (permalink / raw)
To: kaber; +Cc: netfilter-devel, netdev
From: kaber@trash.net
Date: Fri, 12 Nov 2010 16:19:30 +0100
> Hi Dave,
>
> The following two patches fix some netfilter bugs:
>
> - missing parentheses in NF_HOOK_COND, breaking error propagation for
> dropped packets. From Eric Paris.
>
> - incorrect checking for overlapping fragments in IPv6 conntrack
> reassembly. From Shan Wei
>
> Please apply or pull from:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6.git
Pulled, thanks Patrick.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 0/2] netfilter: netfilter fixes
@ 2010-11-12 15:19 kaber
2010-11-12 19:07 ` David Miller
0 siblings, 1 reply; 6+ messages in thread
From: kaber @ 2010-11-12 15:19 UTC (permalink / raw)
To: davem; +Cc: netfilter-devel, netdev
Hi Dave,
The following two patches fix some netfilter bugs:
- missing parentheses in NF_HOOK_COND, breaking error propagation for
dropped packets. From Eric Paris.
- incorrect checking for overlapping fragments in IPv6 conntrack
reassembly. From Shan Wei
Please apply or pull from:
git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6.git
Thanks!
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2010-11-12 19:07 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-05-31 16:14 [PATCH 0/2] netfilter: netfilter fixes kaber
2010-05-31 16:14 ` [PATCH 1/2] netfilter: don't xt_jumpstack_alloc twice in xt_register_table kaber
2010-05-31 16:14 ` [PATCH 2/2] netfilter: xtables: stackptr should be percpu kaber
2010-06-01 6:45 ` [PATCH 0/2] netfilter: netfilter fixes David Miller
2010-11-12 15:19 kaber
2010-11-12 19:07 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.