[PATCH nf-next] netfilter: conntrack: avoid same-timeout update

[PATCH nf-next] netfilter: conntrack: avoid same-timeout update

[Florian Westphal]

No need to dirty a cache line if timeout is unchanged.
Also, WARN() is useless here: we crash on 'skb->len' access
if skb is NULL.

Last, ct->timeout is u32, not 'unsigned long' so adapt the
function prototype accordingly.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 include/net/netfilter/nf_conntrack.h | 10 +++++-----
 net/netfilter/nf_conntrack_core.c    |  9 ++++-----
 2 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index b5aac5ae5129..2270ee5202e3 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -190,23 +190,23 @@ bool nf_ct_get_tuplepr(const struct sk_buff *skb, unsigned int nhoff,
 
 void __nf_ct_refresh_acct(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
 			  const struct sk_buff *skb,
-			  unsigned long extra_jiffies, int do_acct);
+			  u32, bool do_acct);
 
 /* Refresh conntrack for this many jiffies and do accounting */
 static inline void nf_ct_refresh_acct(struct nf_conn *ct,
 				      enum ip_conntrack_info ctinfo,
 				      const struct sk_buff *skb,
-				      unsigned long extra_jiffies)
+				      u32 extra_jiffies)
 {
-	__nf_ct_refresh_acct(ct, ctinfo, skb, extra_jiffies, 1);
+	__nf_ct_refresh_acct(ct, ctinfo, skb, extra_jiffies, true);
 }
 
 /* Refresh conntrack for this many jiffies */
 static inline void nf_ct_refresh(struct nf_conn *ct,
 				 const struct sk_buff *skb,
-				 unsigned long extra_jiffies)
+				 u32 extra_jiffies)
 {
-	__nf_ct_refresh_acct(ct, 0, skb, extra_jiffies, 0);
+	__nf_ct_refresh_acct(ct, 0, skb, extra_jiffies, false);
 }
 
 /* kill conntrack and do accounting */
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index e139c256e269..a6488d53b7d3 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1752,11 +1752,9 @@ EXPORT_SYMBOL_GPL(nf_conntrack_alter_reply);
 void __nf_ct_refresh_acct(struct nf_conn *ct,
 			  enum ip_conntrack_info ctinfo,
 			  const struct sk_buff *skb,
-			  unsigned long extra_jiffies,
-			  int do_acct)
+			  u32 extra_jiffies,
+			  bool do_acct)
 {
-	WARN_ON(!skb);
-
 	/* Only update if this is not a fixed timeout */
 	if (test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status))
 		goto acct;
@@ -1765,7 +1763,8 @@ void __nf_ct_refresh_acct(struct nf_conn *ct,
 	if (nf_ct_is_confirmed(ct))
 		extra_jiffies += nfct_time_stamp;
 
-	ct->timeout = extra_jiffies;
+	if (ct->timeout != extra_jiffies)
+		ct->timeout = extra_jiffies;
 acct:
 	if (do_acct)
 		nf_ct_acct_update(ct, ctinfo, skb->len);
-- 
2.19.2

Re: [PATCH nf-next] netfilter: conntrack: avoid same-timeout update

[Phil Sutter]

On Thu, Feb 21, 2019 at 03:38:29PM +0100, Florian Westphal wrote:
> No need to dirty a cache line if timeout is unchanged.
> Also, WARN() is useless here: we crash on 'skb->len' access
> if skb is NULL.
> 
> Last, ct->timeout is u32, not 'unsigned long' so adapt the
> function prototype accordingly.
> 
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
>  include/net/netfilter/nf_conntrack.h | 10 +++++-----
>  net/netfilter/nf_conntrack_core.c    |  9 ++++-----
>  2 files changed, 9 insertions(+), 10 deletions(-)
> 
> diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
> index b5aac5ae5129..2270ee5202e3 100644
> --- a/include/net/netfilter/nf_conntrack.h
> +++ b/include/net/netfilter/nf_conntrack.h
> @@ -190,23 +190,23 @@ bool nf_ct_get_tuplepr(const struct sk_buff *skb, unsigned int nhoff,
>  
>  void __nf_ct_refresh_acct(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
>  			  const struct sk_buff *skb,
> -			  unsigned long extra_jiffies, int do_acct);
> +			  u32, bool do_acct);

Maybe not worth a respin, but this mix of named and unnamed parameters
in function prototype is probably not intentional.

Cheers, Phil

Re: [PATCH nf-next] netfilter: conntrack: avoid same-timeout update

[Florian Westphal]

Phil Sutter <phil@nwl.cc> wrote:
> >  void __nf_ct_refresh_acct(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
> >  			  const struct sk_buff *skb,
> > -			  unsigned long extra_jiffies, int do_acct);
> > +			  u32, bool do_acct);
> 
> Maybe not worth a respin, but this mix of named and unnamed parameters
> in function prototype is probably not intentional.

Right, its not -- I don't plan to send a v2 though.

Re: [PATCH nf-next] netfilter: conntrack: avoid same-timeout update

[Pablo Neira Ayuso]

On Thu, Feb 21, 2019 at 03:38:29PM +0100, Florian Westphal wrote:
> No need to dirty a cache line if timeout is unchanged.
> Also, WARN() is useless here: we crash on 'skb->len' access
> if skb is NULL.
> 
> Last, ct->timeout is u32, not 'unsigned long' so adapt the
> function prototype accordingly.

Applied, thanks.