Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1d45209d authored by Eric Dumazet's avatar Eric Dumazet Committed by Patrick McHardy
Browse files

netfilter: nf_conntrack: Reduce conntrack count in nf_conntrack_free() 



We use RCU to defer freeing of conntrack structures. In DOS situation, RCU might
accumulate about 10.000 elements per CPU in its internal queues. To get accurate
conntrack counts (at the expense of slightly more RAM used), we might consider
conntrack counter not taking into account "about to be freed elements, waiting
in RCU queues". We thus decrement it in nf_conntrack_free(), not in the RCU
callback.

Signed-off-by: default avatarEric Dumazet <dada1@cosmosbay.com>
Tested-by: default avatarJoakim Tjernlund <Joakim.Tjernlund@transmode.se>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent dd5b6ce6

net/netfilter/nf_conntrack_core.c

+3 −2
Original line number Original line Diff line number Diff line
@@ -517,16 +517,17 @@ EXPORT_SYMBOL_GPL(nf_conntrack_alloc); 
static void nf_conntrack_free_rcu(struct rcu_head *head)

static void nf_conntrack_free_rcu(struct rcu_head *head)

{

{

	struct nf_conn *ct = container_of(head, struct nf_conn, rcu);

	struct nf_conn *ct = container_of(head, struct nf_conn, rcu);

	struct net *net = nf_ct_net(ct);





	nf_ct_ext_free(ct);

	nf_ct_ext_free(ct);

	kmem_cache_free(nf_conntrack_cachep, ct);

	kmem_cache_free(nf_conntrack_cachep, ct);

	atomic_dec(&net->ct.count);

}

}





void nf_conntrack_free(struct nf_conn *ct)

void nf_conntrack_free(struct nf_conn *ct)

{

{

	struct net *net = nf_ct_net(ct);



	nf_ct_ext_destroy(ct);

	nf_ct_ext_destroy(ct);

	atomic_dec(&net->ct.count);

	call_rcu(&ct->rcu, nf_conntrack_free_rcu);

	call_rcu(&ct->rcu, nf_conntrack_free_rcu);

}

}

EXPORT_SYMBOL_GPL(nf_conntrack_free);

EXPORT_SYMBOL_GPL(nf_conntrack_free);