Re: 2.4 kernels and max # of rules with iptables

[Gustavo Zacarias <gustavoz@gentoo.org>]

[-- Attachment #1.1: Type: text/plain, Size: 286 bytes --]

David S. Miller wrote:

> You _could_ experiment with making the code there use
> vmalloc()/vfree() instead, and if you get it working cleanly I'd be
> happy to add such a patch to fix this.

Tested with 5000+ rules.
Does it look clean enough?

-- 
Gustavo Zacarias
Gentoo/SPARC monkey

[-- Attachment #1.2: 2.4-sparc64-netfilter-ioctl32.patch --]
[-- Type: text/x-patch, Size: 1246 bytes --]

diff -Nura linux-2.4.31/arch/sparc64/kernel/sys_sparc32.c linux-2.4.31.netfilter/arch/sparc64/kernel/sys_sparc32.c
--- linux-2.4.31/arch/sparc64/kernel/sys_sparc32.c	2005-04-03 22:42:19.000000000 -0300
+++ linux-2.4.31.netfilter/arch/sparc64/kernel/sys_sparc32.c	2005-08-22 12:34:14.000000000 -0300
@@ -50,6 +50,7 @@
 #include <linux/in.h>
 #include <linux/icmpv6.h>
 #include <linux/sysctl.h>
+#include <linux/vmalloc.h>
 #include <linux/dnotify.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
 
@@ -2919,12 +2920,12 @@
 	if (optlen != kreplsize)
 		return -ENOPROTOOPT;
 
-	krepl = (struct ipt_replace *)kmalloc(kreplsize, GFP_KERNEL);
+	krepl = (struct ipt_replace *)vmalloc(kreplsize);
 	if (krepl == NULL)
 		return -ENOMEM;
 
 	if (copy_from_user(krepl, optval, kreplsize)) {
-		kfree(krepl);
+		vfree(krepl);
 		return -EFAULT;
 	}
 
@@ -2935,7 +2936,7 @@
 	krepl->counters = (struct ipt_counters *)kmalloc(
 					kcountersize, GFP_KERNEL);
 	if (krepl->counters == NULL) {
-		kfree(krepl);
+		vfree(krepl);
 		return -ENOMEM;
 	}
 
@@ -2949,8 +2950,8 @@
 		copy_to_user(counters32, krepl->counters, kcountersize))
 			ret = -EFAULT;
 
-	kfree(krepl->counters);
-	kfree(krepl);
+	vfree(krepl->counters);
+	vfree(krepl);
 
 	return ret;
 }

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 256 bytes --]