From: Florian Westphal <fw@strlen.de>
To: <netdev@vger.kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>,
<netfilter-devel@vger.kernel.org>,
Pablo Neira Ayuso <pablo@netfilter.org>
Subject: [PATCH net 1/7] netfilter: nf_tables: do not remove elements if set backend implements .abort
Date: Thu, 12 Oct 2023 10:57:04 +0200 [thread overview]
Message-ID: <20231012085724.15155-2-fw@strlen.de> (raw)
In-Reply-To: <20231012085724.15155-1-fw@strlen.de>
From: Pablo Neira Ayuso <pablo@netfilter.org>
pipapo set backend maintains two copies of the datastructure, removing
the elements from the copy that is going to be discarded slows down
the abort path significantly, from several minutes to few seconds after
this patch.
Fixes: 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
---
net/netfilter/nf_tables_api.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index a72b6aeefb1b..c3de3791cabd 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -10347,7 +10347,10 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
break;
}
te = (struct nft_trans_elem *)trans->data;
- nft_setelem_remove(net, te->set, &te->elem);
+ if (!te->set->ops->abort ||
+ nft_setelem_is_catchall(te->set, &te->elem))
+ nft_setelem_remove(net, te->set, &te->elem);
+
if (!nft_setelem_is_catchall(te->set, &te->elem))
atomic_dec(&te->set->nelems);
--
2.41.0
next prev parent reply other threads:[~2023-10-12 8:57 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-12 8:57 [PATCH net 0/7] netfilter updates for net Florian Westphal
2023-10-12 8:57 ` Florian Westphal [this message]
2023-10-14 1:00 ` [PATCH net 1/7] netfilter: nf_tables: do not remove elements if set backend implements .abort patchwork-bot+netdevbpf
2023-10-12 8:57 ` [PATCH net 2/7] netfilter: nfnetlink_log: silence bogus compiler warning Florian Westphal
2023-10-12 8:57 ` [PATCH net 3/7] netfilter: nf_tables: Annotate struct nft_pipapo_match with __counted_by Florian Westphal
2023-10-12 8:57 ` [PATCH net 4/7] netfilter: nf_tables: do not refresh timeout when resetting element Florian Westphal
2023-10-12 8:57 ` [PATCH net 5/7] nf_tables: fix NULL pointer dereference in nft_inner_init() Florian Westphal
2023-10-12 8:57 ` [PATCH net 6/7] nf_tables: fix NULL pointer dereference in nft_expr_inner_parse() Florian Westphal
2023-10-12 8:57 ` [PATCH net 7/7] netfilter: nft_payload: fix wrong mac header matching Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231012085724.15155-2-fw@strlen.de \
--to=fw@strlen.de \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox