[PATCH nf-next V2] netfilter: nf_ct_helper: use nf_ct_iterate_destroy to unlink helper objs

[PATCH nf-next V2] netfilter: nf_ct_helper: use nf_ct_iterate_destroy to unlink helper objs

[Liping Zhang]

From: Liping Zhang <zlpnobody@gmail.com>

When we unlink the helper objects, we will iterate the nf_conntrack_hash,
iterate the unconfirmed list, handle the hash resize situation, etc.

Actually this logic is same as the nf_ct_iterate_destroy, so we can use
it to remove these copy & paste codes.

Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
---
 V2: rebase on Florian's patch set "netfilter: conntrack: rework nf_ct_iterate,
     part 1."

 net/netfilter/nf_conntrack_helper.c | 50 +++----------------------------------
 1 file changed, 4 insertions(+), 46 deletions(-)

diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 3a60efa..e9c1962 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -274,16 +274,16 @@ int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
 EXPORT_SYMBOL_GPL(__nf_ct_try_assign_helper);
 
 /* appropriate ct lock protecting must be taken by caller */
-static inline int unhelp(struct nf_conntrack_tuple_hash *i,
-			 const struct nf_conntrack_helper *me)
+static int unhelp(struct nf_conn *ct, void *me)
 {
-	struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(i);
 	struct nf_conn_help *help = nfct_help(ct);
 
 	if (help && rcu_dereference_raw(help->helper) == me) {
 		nf_conntrack_event(IPCT_HELPER, ct);
 		RCU_INIT_POINTER(help->helper, NULL);
 	}
+
+	/* We are not intended to delete this conntrack. */
 	return 0;
 }
 
@@ -425,33 +425,10 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me)
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_helper_register);
 
-static void __nf_conntrack_helper_unregister(struct nf_conntrack_helper *me,
-					     struct net *net)
-{
-	struct nf_conntrack_tuple_hash *h;
-	const struct hlist_nulls_node *nn;
-	int cpu;
-
-	/* Get rid of expecteds, set helpers to NULL. */
-	for_each_possible_cpu(cpu) {
-		struct ct_pcpu *pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu);
-
-		spin_lock_bh(&pcpu->lock);
-		hlist_nulls_for_each_entry(h, nn, &pcpu->unconfirmed, hnnode)
-			unhelp(h, me);
-		spin_unlock_bh(&pcpu->lock);
-	}
-}
-
 void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)
 {
-	struct nf_conntrack_tuple_hash *h;
 	struct nf_conntrack_expect *exp;
 	const struct hlist_node *next;
-	const struct hlist_nulls_node *nn;
-	unsigned int last_hsize;
-	spinlock_t *lock;
-	struct net *net;
 	unsigned int i;
 
 	mutex_lock(&nf_ct_helper_mutex);
@@ -479,26 +456,7 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)
 	}
 	spin_unlock_bh(&nf_conntrack_expect_lock);
 
-	rtnl_lock();
-	for_each_net(net)
-		__nf_conntrack_helper_unregister(me, net);
-	rtnl_unlock();
-
-	local_bh_disable();
-restart:
-	last_hsize = nf_conntrack_htable_size;
-	for (i = 0; i < last_hsize; i++) {
-		lock = &nf_conntrack_locks[i % CONNTRACK_LOCKS];
-		nf_conntrack_lock(lock);
-		if (last_hsize != nf_conntrack_htable_size) {
-			spin_unlock(lock);
-			goto restart;
-		}
-		hlist_nulls_for_each_entry(h, nn, &nf_conntrack_hash[i], hnnode)
-			unhelp(h, me);
-		spin_unlock(lock);
-	}
-	local_bh_enable();
+	nf_ct_iterate_destroy(unhelp, me);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister);
 
-- 
2.5.5

Re: [PATCH nf-next V2] netfilter: nf_ct_helper: use nf_ct_iterate_destroy to unlink helper objs

[kbuild test robot]

[-- Attachment #1: Type: text/plain, Size: 6212 bytes --]

Hi Liping,

[auto build test ERROR on nf/master]
[also build test ERROR on v4.12-rc2 next-20170526]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url:    https://github.com/0day-ci/linux/commits/Liping-Zhang/netfilter-nf_ct_helper-use-nf_ct_iterate_destroy-to-unlink-helper-objs/20170528-230817
base:   https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
config: x86_64-randconfig-x014-201722 (attached as .config)
compiler: gcc-6 (Debian 6.2.0-3) 6.2.0 20160901
reproduce:
        # save the attached .config to linux build tree
        make ARCH=x86_64 

All errors (new ones prefixed by >>):

   net//netfilter/nf_conntrack_helper.c: In function 'nf_conntrack_helper_unregister':
>> net//netfilter/nf_conntrack_helper.c:471:2: error: implicit declaration of function 'nf_ct_iterate_destroy' [-Werror=implicit-function-declaration]
     nf_ct_iterate_destroy(unhelp, me);
     ^~~~~~~~~~~~~~~~~~~~~
   Cyclomatic Complexity 5 include/linux/compiler.h:__read_once_size
   Cyclomatic Complexity 5 include/linux/compiler.h:__write_once_size
   Cyclomatic Complexity 3 arch/x86/include/asm/bitops.h:set_bit
   Cyclomatic Complexity 1 arch/x86/include/asm/bitops.h:constant_test_bit
   Cyclomatic Complexity 1 arch/x86/include/asm/atomic.h:atomic_set
   Cyclomatic Complexity 1 include/linux/list.h:__list_del
   Cyclomatic Complexity 1 include/linux/spinlock.h:spin_lock_bh
   Cyclomatic Complexity 1 include/linux/spinlock.h:spin_unlock_bh
   Cyclomatic Complexity 1 include/linux/refcount.h:refcount_set
   Cyclomatic Complexity 1 include/net/net_namespace.h:read_pnet
   Cyclomatic Complexity 1 include/linux/module.h:module_is_live
   Cyclomatic Complexity 3 include/linux/module.h:try_module_get
   Cyclomatic Complexity 1 include/linux/module.h:module_put
   Cyclomatic Complexity 1 include/net/netfilter/nf_conntrack.h:nf_ct_l3num
   Cyclomatic Complexity 1 include/net/netfilter/nf_conntrack.h:nf_ct_net
   Cyclomatic Complexity 1 include/net/netfilter/nf_conntrack_extend.h:__nf_ct_ext_exist
   Cyclomatic Complexity 3 include/net/netfilter/nf_conntrack_extend.h:nf_ct_ext_exist
   Cyclomatic Complexity 2 include/net/netfilter/nf_conntrack_extend.h:__nf_ct_ext_find
   Cyclomatic Complexity 1 include/net/netfilter/nf_conntrack_helper.h:nfct_help
   Cyclomatic Complexity 1 include/net/netfilter/nf_conntrack_ecache.h:nf_conntrack_event
   Cyclomatic Complexity 1 net//netfilter/nf_conntrack_helper.c:helper_hash
   Cyclomatic Complexity 4 net//netfilter/nf_conntrack_helper.c:unhelp
   Cyclomatic Complexity 17 net//netfilter/nf_conntrack_helper.c:__nf_conntrack_helper_find
   Cyclomatic Complexity 14 include/net/netfilter/nf_conntrack_tuple.h:nf_ct_tuple_src_mask_cmp
   Cyclomatic Complexity 7 net//netfilter/nf_conntrack_helper.c:__nf_ct_helper_find
   Cyclomatic Complexity 5 net//netfilter/nf_conntrack_helper.c:nf_ct_helper_expectfn_find_by_name
   Cyclomatic Complexity 5 net//netfilter/nf_conntrack_helper.c:nf_ct_helper_expectfn_find_by_symbol
   Cyclomatic Complexity 3 include/linux/list.h:__hlist_del
   Cyclomatic Complexity 1 include/linux/rculist.h:hlist_del_rcu
   Cyclomatic Complexity 1 include/linux/rcupdate.h:rcu_lock_acquire
   Cyclomatic Complexity 5 include/linux/rcupdate.h:rcu_read_lock
   Cyclomatic Complexity 1 include/linux/rcupdate.h:rcu_lock_release
   Cyclomatic Complexity 5 include/linux/rcupdate.h:rcu_read_unlock
   Cyclomatic Complexity 10 net//netfilter/nf_conntrack_helper.c:nf_conntrack_helper_try_module_get
   Cyclomatic Complexity 1 net//netfilter/nf_conntrack_helper.c:nf_conntrack_helper_put
   Cyclomatic Complexity 3 net//netfilter/nf_conntrack_helper.c:nf_ct_helper_ext_add
   Cyclomatic Complexity 6 net//netfilter/nf_conntrack_helper.c:nf_ct_lookup_helper
   Cyclomatic Complexity 30 net//netfilter/nf_conntrack_helper.c:__nf_ct_try_assign_helper
   Cyclomatic Complexity 4 include/linux/rculist.h:__list_add_rcu
   Cyclomatic Complexity 1 include/linux/rculist.h:list_add_rcu
   Cyclomatic Complexity 1 net//netfilter/nf_conntrack_helper.c:nf_ct_helper_expectfn_register
   Cyclomatic Complexity 2 include/linux/list.h:__list_del_entry
   Cyclomatic Complexity 1 include/linux/rculist.h:list_del_rcu
   Cyclomatic Complexity 1 net//netfilter/nf_conntrack_helper.c:nf_ct_helper_expectfn_unregister
   Cyclomatic Complexity 5 net//netfilter/nf_conntrack_helper.c:nf_ct_helper_log
   Cyclomatic Complexity 5 include/linux/rculist.h:hlist_add_head_rcu
   Cyclomatic Complexity 27 net//netfilter/nf_conntrack_helper.c:nf_conntrack_helper_register
   Cyclomatic Complexity 1 include/linux/lockdep.h:lock_is_held
   Cyclomatic Complexity 13 net//netfilter/nf_conntrack_helper.c:nf_conntrack_helper_unregister
   Cyclomatic Complexity 2 net//netfilter/nf_conntrack_helper.c:nf_conntrack_helpers_unregister
   Cyclomatic Complexity 6 net//netfilter/nf_conntrack_helper.c:nf_conntrack_helpers_register
   Cyclomatic Complexity 3 net//netfilter/nf_conntrack_helper.c:nf_ct_helper_init
   Cyclomatic Complexity 7 net//netfilter/nf_conntrack_helper.c:nf_conntrack_helper_init_sysctl
   Cyclomatic Complexity 1 net//netfilter/nf_conntrack_helper.c:nf_conntrack_helper_fini_sysctl
   Cyclomatic Complexity 15 net//netfilter/nf_conntrack_helper.c:nf_ct_helper_destroy
   Cyclomatic Complexity 1 net//netfilter/nf_conntrack_helper.c:nf_conntrack_helper_pernet_init
   Cyclomatic Complexity 1 net//netfilter/nf_conntrack_helper.c:nf_conntrack_helper_pernet_fini
   Cyclomatic Complexity 5 net//netfilter/nf_conntrack_helper.c:nf_conntrack_helper_init
   Cyclomatic Complexity 1 net//netfilter/nf_conntrack_helper.c:nf_conntrack_helper_fini
   cc1: some warnings being treated as errors

vim +/nf_ct_iterate_destroy +471 net//netfilter/nf_conntrack_helper.c

   465						) == me || exp->helper == me))
   466					nf_ct_remove_expect(exp);
   467			}
   468		}
   469		spin_unlock_bh(&nf_conntrack_expect_lock);
   470	
 > 471		nf_ct_iterate_destroy(unhelp, me);
   472	}
   473	EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister);
   474	

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 28695 bytes --]

Re: [PATCH nf-next V2] netfilter: nf_ct_helper: use nf_ct_iterate_destroy to unlink helper objs

[Pablo Neira Ayuso]

On Sun, May 28, 2017 at 10:35:52PM +0800, Liping Zhang wrote:
> From: Liping Zhang <zlpnobody@gmail.com>
> 
> When we unlink the helper objects, we will iterate the nf_conntrack_hash,
> iterate the unconfirmed list, handle the hash resize situation, etc.
> 
> Actually this logic is same as the nf_ct_iterate_destroy, so we can use
> it to remove these copy & paste codes.

Applied to nf-next, thanks.