* [PATCH] netfilter: nf_tables: handle more than 8 * PAGE_SIZE set name allocations
@ 2014-03-07 11:34 Patrick McHardy
2014-03-12 16:18 ` Pablo Neira Ayuso
0 siblings, 1 reply; 4+ messages in thread
From: Patrick McHardy @ 2014-03-07 11:34 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel
We currently have a limit of 8 * PAGE_SIZE anonymous sets. Lift that limit
by continuing the scan if the entire page is exhausted.
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
net/netfilter/nf_tables_api.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index f25d011..89d7ec4 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2004,7 +2004,7 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
const struct nft_set *i;
const char *p;
unsigned long *inuse;
- unsigned int n = 0;
+ unsigned int n = 0, min = 0;
p = strnchr(name, IFNAMSIZ, '%');
if (p != NULL) {
@@ -2014,23 +2014,28 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
if (inuse == NULL)
return -ENOMEM;
-
+cont:
list_for_each_entry(i, &ctx->table->sets, list) {
int tmp;
if (!sscanf(i->name, name, &tmp))
continue;
- if (tmp < 0 || tmp >= BITS_PER_BYTE * PAGE_SIZE)
+ if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
continue;
- set_bit(tmp, inuse);
+ set_bit(tmp - min, inuse);
}
n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
+ if (n >= BITS_PER_BYTE * PAGE_SIZE) {
+ min += BITS_PER_BYTE * PAGE_SIZE;
+ memset(inuse, 0, PAGE_SIZE);
+ goto cont;
+ }
free_page((unsigned long)inuse);
}
- snprintf(set->name, sizeof(set->name), name, n);
+ snprintf(set->name, sizeof(set->name), name, min + n);
list_for_each_entry(i, &ctx->table->sets, list) {
if (!strcmp(set->name, i->name))
return -ENFILE;
--
1.8.5.3
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] netfilter: nf_tables: handle more than 8 * PAGE_SIZE set name allocations
2014-03-07 11:34 [PATCH] netfilter: nf_tables: handle more than 8 * PAGE_SIZE set name allocations Patrick McHardy
@ 2014-03-12 16:18 ` Pablo Neira Ayuso
2014-03-26 12:20 ` Patrick McHardy
0 siblings, 1 reply; 4+ messages in thread
From: Pablo Neira Ayuso @ 2014-03-12 16:18 UTC (permalink / raw)
To: Patrick McHardy; +Cc: netfilter-devel
On Fri, Mar 07, 2014 at 12:34:05PM +0100, Patrick McHardy wrote:
> We currently have a limit of 8 * PAGE_SIZE anonymous sets. Lift that limit
> by continuing the scan if the entire page is exhausted.
>
> Signed-off-by: Patrick McHardy <kaber@trash.net>
> ---
> net/netfilter/nf_tables_api.c | 15 ++++++++++-----
> 1 file changed, 10 insertions(+), 5 deletions(-)
>
> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> index f25d011..89d7ec4 100644
> --- a/net/netfilter/nf_tables_api.c
> +++ b/net/netfilter/nf_tables_api.c
> @@ -2004,7 +2004,7 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
> const struct nft_set *i;
> const char *p;
> unsigned long *inuse;
> - unsigned int n = 0;
> + unsigned int n = 0, min = 0;
>
> p = strnchr(name, IFNAMSIZ, '%');
> if (p != NULL) {
> @@ -2014,23 +2014,28 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
> inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
> if (inuse == NULL)
> return -ENOMEM;
> -
> +cont:
> list_for_each_entry(i, &ctx->table->sets, list) {
> int tmp;
>
> if (!sscanf(i->name, name, &tmp))
> continue;
> - if (tmp < 0 || tmp >= BITS_PER_BYTE * PAGE_SIZE)
> + if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
I think we can break looping if tmp >= min + BITS_PER_BYTE * PAGE_SIZE
fulfills (assuming the list of sets is ordered).
> continue;
>
> - set_bit(tmp, inuse);
> + set_bit(tmp - min, inuse);
> }
>
> n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
> + if (n >= BITS_PER_BYTE * PAGE_SIZE) {
> + min += BITS_PER_BYTE * PAGE_SIZE;
> + memset(inuse, 0, PAGE_SIZE);
> + goto cont;
If the page is full, we start iterating over the set list from the
beginning.
> + }
> free_page((unsigned long)inuse);
> }
>
> - snprintf(set->name, sizeof(set->name), name, n);
> + snprintf(set->name, sizeof(set->name), name, min + n);
> list_for_each_entry(i, &ctx->table->sets, list) {
> if (!strcmp(set->name, i->name))
> return -ENFILE;
> --
> 1.8.5.3
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] netfilter: nf_tables: handle more than 8 * PAGE_SIZE set name allocations
2014-03-12 16:18 ` Pablo Neira Ayuso
@ 2014-03-26 12:20 ` Patrick McHardy
2014-03-26 13:08 ` Pablo Neira Ayuso
0 siblings, 1 reply; 4+ messages in thread
From: Patrick McHardy @ 2014-03-26 12:20 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel
On Wed, Mar 12, 2014 at 05:18:00PM +0100, Pablo Neira Ayuso wrote:
> On Fri, Mar 07, 2014 at 12:34:05PM +0100, Patrick McHardy wrote:
> > We currently have a limit of 8 * PAGE_SIZE anonymous sets. Lift that limit
> > by continuing the scan if the entire page is exhausted.
> >
> > Signed-off-by: Patrick McHardy <kaber@trash.net>
> > ---
> > net/netfilter/nf_tables_api.c | 15 ++++++++++-----
> > 1 file changed, 10 insertions(+), 5 deletions(-)
> >
> > diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> > index f25d011..89d7ec4 100644
> > --- a/net/netfilter/nf_tables_api.c
> > +++ b/net/netfilter/nf_tables_api.c
> > @@ -2004,7 +2004,7 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
> > const struct nft_set *i;
> > const char *p;
> > unsigned long *inuse;
> > - unsigned int n = 0;
> > + unsigned int n = 0, min = 0;
> >
> > p = strnchr(name, IFNAMSIZ, '%');
> > if (p != NULL) {
> > @@ -2014,23 +2014,28 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
> > inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
> > if (inuse == NULL)
> > return -ENOMEM;
> > -
> > +cont:
> > list_for_each_entry(i, &ctx->table->sets, list) {
> > int tmp;
> >
> > if (!sscanf(i->name, name, &tmp))
> > continue;
> > - if (tmp < 0 || tmp >= BITS_PER_BYTE * PAGE_SIZE)
> > + if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
>
> I think we can break looping if tmp >= min + BITS_PER_BYTE * PAGE_SIZE
> fulfills (assuming the list of sets is ordered).
It's not, we really need to continue here.
>
> > continue;
> >
> > - set_bit(tmp, inuse);
> > + set_bit(tmp - min, inuse);
> > }
> >
> > n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
> > + if (n >= BITS_PER_BYTE * PAGE_SIZE) {
> > + min += BITS_PER_BYTE * PAGE_SIZE;
> > + memset(inuse, 0, PAGE_SIZE);
> > + goto cont;
>
> If the page is full, we start iterating over the set list from the
> beginning.
Yes, also necessary since the list is not ordered. We always pick the first
free set name and add it at the end.
>
> > + }
> > free_page((unsigned long)inuse);
> > }
> >
> > - snprintf(set->name, sizeof(set->name), name, n);
> > + snprintf(set->name, sizeof(set->name), name, min + n);
> > list_for_each_entry(i, &ctx->table->sets, list) {
> > if (!strcmp(set->name, i->name))
> > return -ENFILE;
> > --
> > 1.8.5.3
> >
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] netfilter: nf_tables: handle more than 8 * PAGE_SIZE set name allocations
2014-03-26 12:20 ` Patrick McHardy
@ 2014-03-26 13:08 ` Pablo Neira Ayuso
0 siblings, 0 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2014-03-26 13:08 UTC (permalink / raw)
To: Patrick McHardy; +Cc: netfilter-devel
On Wed, Mar 26, 2014 at 12:20:46PM +0000, Patrick McHardy wrote:
> On Wed, Mar 12, 2014 at 05:18:00PM +0100, Pablo Neira Ayuso wrote:
> > On Fri, Mar 07, 2014 at 12:34:05PM +0100, Patrick McHardy wrote:
> > > We currently have a limit of 8 * PAGE_SIZE anonymous sets. Lift that limit
> > > by continuing the scan if the entire page is exhausted.
> > >
> > > Signed-off-by: Patrick McHardy <kaber@trash.net>
> > > ---
> > > net/netfilter/nf_tables_api.c | 15 ++++++++++-----
> > > 1 file changed, 10 insertions(+), 5 deletions(-)
> > >
> > > diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> > > index f25d011..89d7ec4 100644
> > > --- a/net/netfilter/nf_tables_api.c
> > > +++ b/net/netfilter/nf_tables_api.c
> > > @@ -2004,7 +2004,7 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
> > > const struct nft_set *i;
> > > const char *p;
> > > unsigned long *inuse;
> > > - unsigned int n = 0;
> > > + unsigned int n = 0, min = 0;
> > >
> > > p = strnchr(name, IFNAMSIZ, '%');
> > > if (p != NULL) {
> > > @@ -2014,23 +2014,28 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
> > > inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
> > > if (inuse == NULL)
> > > return -ENOMEM;
> > > -
> > > +cont:
> > > list_for_each_entry(i, &ctx->table->sets, list) {
> > > int tmp;
> > >
> > > if (!sscanf(i->name, name, &tmp))
> > > continue;
> > > - if (tmp < 0 || tmp >= BITS_PER_BYTE * PAGE_SIZE)
> > > + if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
> >
> > I think we can break looping if tmp >= min + BITS_PER_BYTE * PAGE_SIZE
> > fulfills (assuming the list of sets is ordered).
>
> It's not, we really need to continue here.
>
> >
> > > continue;
> > >
> > > - set_bit(tmp, inuse);
> > > + set_bit(tmp - min, inuse);
> > > }
> > >
> > > n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
> > > + if (n >= BITS_PER_BYTE * PAGE_SIZE) {
> > > + min += BITS_PER_BYTE * PAGE_SIZE;
> > > + memset(inuse, 0, PAGE_SIZE);
> > > + goto cont;
> >
> > If the page is full, we start iterating over the set list from the
> > beginning.
>
> Yes, also necessary since the list is not ordered. We always pick the first
> free set name and add it at the end.
Right, I misunderstood the logic behind the patch. I'll push this
patch, thanks Patrick.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2014-03-26 13:09 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-03-07 11:34 [PATCH] netfilter: nf_tables: handle more than 8 * PAGE_SIZE set name allocations Patrick McHardy
2014-03-12 16:18 ` Pablo Neira Ayuso
2014-03-26 12:20 ` Patrick McHardy
2014-03-26 13:08 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).