From: Dmitry Safonov <dima@arista.com>
To: Vasily Khoruzhick <vasilykh@arista.com>,
Pablo Neira Ayuso <pablo@netfilter.org>,
Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>,
Florian Westphal <fw@strlen.de>,
"David S. Miller" <davem@davemloft.net>,
netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Subject: Re: [PATCH] netfilter: conntrack: fix calculation of next bucket number in early_drop
Date: Thu, 25 Oct 2018 05:52:53 +0100 [thread overview]
Message-ID: <a2fa755a-048b-459a-b526-2fe27cbb6574@arista.com> (raw)
In-Reply-To: <20181025034853.23573-1-vasilykh@arista.com>
On 10/25/18 4:48 AM, Vasily Khoruzhick wrote:
> If there's no entry to drop in bucket that corresponds to the hash,
> early_drop() should look for it in other buckets. But since it increments
> hash instead of bucket number, it actually looks in the same bucket 8
> times: hsize is 16k by default (14 bits) and hash is 32-bit value, so
> reciprocal_scale(hash, hsize) returns the same value for hash..hash+7 in
> most cases.
>
> Fix it by increasing bucket number instead of hash and rename _hash
> to bucket to avoid future confusion.
>
> Fixes: 3e86638e9a0b ("netfilter: conntrack: consider ct netns in early_drop logic")
> Cc: <stable@vger.kernel.org> # v4.7+
> Signed-off-by: Vasily Khoruzhick <vasilykh@arista.com>
Nice work!
Reviewed-by: Dmitry Safonov <dima@arista.com>
> ---
> net/netfilter/nf_conntrack_core.c | 11 +++++++----
> 1 file changed, 7 insertions(+), 4 deletions(-)
>
> diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
> index ca1168d67fac..a04af246b184 100644
> --- a/net/netfilter/nf_conntrack_core.c
> +++ b/net/netfilter/nf_conntrack_core.c
> @@ -1073,19 +1073,22 @@ static unsigned int early_drop_list(struct net *net,
> return drops;
> }
>
> -static noinline int early_drop(struct net *net, unsigned int _hash)
> +static noinline int early_drop(struct net *net, unsigned int hash)
> {
> unsigned int i;
>
> for (i = 0; i < NF_CT_EVICTION_RANGE; i++) {
> struct hlist_nulls_head *ct_hash;
> - unsigned int hash, hsize, drops;
> + unsigned int bucket, hsize, drops;
>
> rcu_read_lock();
> nf_conntrack_get_ht(&ct_hash, &hsize);
> - hash = reciprocal_scale(_hash++, hsize);
> + if (!i)
> + bucket = reciprocal_scale(hash, hsize);
> + else
> + bucket = (bucket + 1) % hsize;
>
> - drops = early_drop_list(net, &ct_hash[hash]);
> + drops = early_drop_list(net, &ct_hash[bucket]);
> rcu_read_unlock();
>
> if (drops) {
>
--
Dima
next prev parent reply other threads:[~2018-10-25 4:53 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-25 3:48 [PATCH] netfilter: conntrack: fix calculation of next bucket number in early_drop Vasily Khoruzhick
2018-10-25 4:52 ` Dmitry Safonov [this message]
2018-10-25 6:37 ` Vasiliy Khoruzhick
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=a2fa755a-048b-459a-b526-2fe27cbb6574@arista.com \
--to=dima@arista.com \
--cc=coreteam@netfilter.org \
--cc=davem@davemloft.net \
--cc=fw@strlen.de \
--cc=kadlec@blackhole.kfki.hu \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=stable@vger.kernel.org \
--cc=vasilykh@arista.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).