Re: [PATCH nf-next 2/2] netfilter: nfnetlink: bail out batch processing with EMLINK

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> Stop batch evaluation on the first EMLINK error, ruleset validation is
> expensive and it could take a while before user recovers control after
> sending a batch with too many jump/goto chain.

ok, but...

> Fixes: 0628b123c96d ("netfilter: nfnetlink: add batch support and use it from nf_tables")
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
>  net/netfilter/nfnetlink.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
> index 811d02b4c4f7..315240b2368e 100644
> --- a/net/netfilter/nfnetlink.c
> +++ b/net/netfilter/nfnetlink.c
> @@ -558,6 +558,10 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
>  			 */
>  			if (err)
>  				status |= NFNL_BATCH_FAILURE;
> +
> +			/* EMLINK is fatal, stop processing batch. */
> +			if (err == -EMLINK)
> +				goto done;

... but -EINVAL, -ERANGE or any other validation error is also
fatal, so why do we make an exception for -EMLINK?

Is it because -EMLINK indicates we already spent lots of time
hogging cpu in chain validation and continuing will burn more cycles?

But even if thats the case, I'm not sure its the right choice,
we could also spend lots of time without hitting -EMLINK.

Maybe count errors instead and stop after n fatal errors?
Would also help with rcv buffer overflow on too many
netlink errors.