Re: [PATCH nf] netfilter: nft_set_rbtree: revisit array resize logic

[Chris Arges <carges@cloudflare.com>]

On 2026-03-12 02:14:23, Pablo Neira Ayuso wrote:
> Start by 8192 slots in the array and expand it by pow of 2 to simplify
> growth and shrink logic.
> 
> Use set->ndeact to subtract deactivated elements when calculating the
> number of the slots in the array.
> 
> Add shrink logic to deal with flush+add set, otherwise the array size
> array gets increased artifically.
> 
> Reported-by: Chris Arges <carges@cloudflare.com>
> Fixes: 7e43e0a1141d ("netfilter: nft_set_rbtree: translate rbtree to array for binary search")
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
> Chris, I'm posting this patch, but I am not sure it fits into the
> scenario you described.
>

Pablo,

Thank you, I was able to test this and here are my results:

* v6.18.13 (before nft_set_rbtree patches)
Slab unreclaimable memory increases to 1.4G then levels off.

* v6.18.17 (no patches)
Slab unreclaimable memory increases to 4.9G then levels off.

* v6.18.17 + this patch + nft_set_rbtree: allocate same array size on updates
Slab unreclaimable memory increases to 3.1G then levels off.

* v6.18.17 + this patch + nft_set_rbtree: allocate same array size on updates +
 NFT_ARRAY_INITIAL_SIZE 1024

Slab unreclaimable memory increases to 1.6G then levels off.

So looks like this patch is a huge improvement! One modification I was able to
test was setting NFT_ARRAY_INITIAL_SIZE to 1024. With that change I was getting
a memory profile similar to before this patch:
- 7e43e0a1141d netfilter: nft_set_rbtree: translate rbtree to array for binary search

--chris