linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Dmitry Safonov <dima@arista.com>
To: Vasily Khoruzhick <vasilykh@arista.com>,
	Pablo Neira Ayuso <pablo@netfilter.org>,
	Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>,
	Florian Westphal <fw@strlen.de>,
	"David S. Miller" <davem@davemloft.net>,
	netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
	netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Subject: Re: [PATCH] netfilter: conntrack: fix calculation of next bucket number in early_drop
Date: Thu, 25 Oct 2018 05:52:53 +0100	[thread overview]
Message-ID: <a2fa755a-048b-459a-b526-2fe27cbb6574@arista.com> (raw)
In-Reply-To: <20181025034853.23573-1-vasilykh@arista.com>

On 10/25/18 4:48 AM, Vasily Khoruzhick wrote:
> If there's no entry to drop in bucket that corresponds to the hash,
> early_drop() should look for it in other buckets. But since it increments
> hash instead of bucket number, it actually looks in the same bucket 8
> times: hsize is 16k by default (14 bits) and hash is 32-bit value, so
> reciprocal_scale(hash, hsize) returns the same value for hash..hash+7 in
> most cases.
> 
> Fix it by increasing bucket number instead of hash and rename _hash
> to bucket to avoid future confusion.
> 
> Fixes: 3e86638e9a0b ("netfilter: conntrack: consider ct netns in early_drop logic")
> Cc: <stable@vger.kernel.org> # v4.7+
> Signed-off-by: Vasily Khoruzhick <vasilykh@arista.com>

Nice work!

Reviewed-by: Dmitry Safonov <dima@arista.com>

> ---
>   net/netfilter/nf_conntrack_core.c | 11 +++++++----
>   1 file changed, 7 insertions(+), 4 deletions(-)
> 
> diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
> index ca1168d67fac..a04af246b184 100644
> --- a/net/netfilter/nf_conntrack_core.c
> +++ b/net/netfilter/nf_conntrack_core.c
> @@ -1073,19 +1073,22 @@ static unsigned int early_drop_list(struct net *net,
>   	return drops;
>   }
>   
> -static noinline int early_drop(struct net *net, unsigned int _hash)
> +static noinline int early_drop(struct net *net, unsigned int hash)
>   {
>   	unsigned int i;
>   
>   	for (i = 0; i < NF_CT_EVICTION_RANGE; i++) {
>   		struct hlist_nulls_head *ct_hash;
> -		unsigned int hash, hsize, drops;
> +		unsigned int bucket, hsize, drops;
>   
>   		rcu_read_lock();
>   		nf_conntrack_get_ht(&ct_hash, &hsize);
> -		hash = reciprocal_scale(_hash++, hsize);
> +		if (!i)
> +			bucket = reciprocal_scale(hash, hsize);
> +		else
> +			bucket = (bucket + 1) % hsize;
>   
> -		drops = early_drop_list(net, &ct_hash[hash]);
> +		drops = early_drop_list(net, &ct_hash[bucket]);
>   		rcu_read_unlock();
>   
>   		if (drops) {
> 

-- 
           Dima

  reply	other threads:[~2018-10-25  4:53 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-10-25  3:48 [PATCH] netfilter: conntrack: fix calculation of next bucket number in early_drop Vasily Khoruzhick
2018-10-25  4:52 ` Dmitry Safonov [this message]
2018-10-25  6:37   ` Vasiliy Khoruzhick

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=a2fa755a-048b-459a-b526-2fe27cbb6574@arista.com \
    --to=dima@arista.com \
    --cc=coreteam@netfilter.org \
    --cc=davem@davemloft.net \
    --cc=fw@strlen.de \
    --cc=kadlec@blackhole.kfki.hu \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=pablo@netfilter.org \
    --cc=stable@vger.kernel.org \
    --cc=vasilykh@arista.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).