linux-kernel - [PATCH] netfilter: Fix wastful cleanup check for unconfirmed conn in get_next

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Tue, 21 Oct 2014 08:31:51 +0800
From:	Feng Gao <gfree.wind@...il.com>
To:	Pablo Neira Ayuso <pablo@...filter.org>,
	Patrick McHardy <kaber@...sh.net>, kadlec@...ckhole.kfki.hu,
	davem@...emloft.net
Cc:	Netfilter Developer Mailing List 
	<netfilter-devel@...r.kernel.org>, coreteam@...filter.org,
	netdev@...r.kernel.org, linux-kernel <linux-kernel@...r.kernel.org>
Subject: [PATCH] netfilter: Fix wastful cleanup check for unconfirmed conn in get_next_corpse

Hi all,

I am sorry to send the patch commit again because the last email is
not plain text and is rejected by some servers.

This is the patch to branch master of kernel.

The function get_next_corpse is only invoked by nf_ct_iterate_cleanup
in one while loop, and it will check the per cpu unconfirmed conntrack
list every time.

I think the whole list of unconfirmed conntracks could be accessed by
one call, so the others are not necessary.

So I move the checks outside the get_next_corpse, and create one new
function clean_up_unconfirmed_conntracks.
Let the nf_ct_iterate_cleanup invokes the
clean_up_unconfirmed_conntracks after the while loop.

These codes have already exist for a long time. Firstly I think maybe
there is some reason, but I fail to get it.

Best Regards
Feng

Download attachment "0001-netfilter-Fix-wastful-cleanup-check-for-unconfirmed-.patch" of type "application/octet-stream" (2964 bytes)