linux-kernel - Re:Re: Performance regression in ip_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 11 Jan 2024 12:22:32 +0100 (CET)
From: Jozsef Kadlecsik <kadlec@...ckhole.kfki.hu>
To: David Wang <00107082@....com>
cc: ale.crismani@...omattic.com, xiaolinkui@...inos.cn, 
    Pablo Neira Ayuso <pablo@...filter.org>, linux-kernel@...r.kernel.org, 
    netfilter-devel@...r.kernel.org
Subject: Re:Re: Performance regression in ip_set_swap on 6.1.69

Hi,

On Thu, 11 Jan 2024, David Wang wrote:

> At 2024-01-11 16:25:46, "Jozsef Kadlecsik" <kadlec@...ckhole.kfki.hu> wrote:
> >
> >
> >Could you check that the patch below fixes the performance regression? 
> >Instead of waiting for the RCU grace period at swapping, call_rcu() is 
> >used at destroying the set.
> 
> Got a compiler error:
> net/netfilter/ipset/ip_set_core.c: In function ‘ip_set_destroy_set_rcu’:
> net/netfilter/ipset/ip_set_core.c:1017:9: error: implicit declaration of function ‘ip_set_destroy_set’; did you mean ‘ip_set_destroy_set_rcu’? [-Werror=implicit-function-declaration]
>  1017 |         ip_set_destroy_set(set);
>       |         ^~~~~~~~~~~~~~~~~~
>       |         ip_set_destroy_set_rcu
> net/netfilter/ipset/ip_set_core.c: At top level:
> net/netfilter/ipset/ip_set_core.c:1183:1: warning: conflicting types for ‘ip_set_destroy_set’; have ‘void(struct ip_set *)’
>  1183 | ip_set_destroy_set(struct ip_set *set)
>       | ^~~~~~~~~~~~~~~~~~
> net/netfilter/ipset/ip_set_core.c:1183:1: error: static declaration of ‘ip_set_destroy_set’ follows non-static declaration
>
>  I move the declaration of ip_set_destroy_set_rcu, make sure it is after 
> the declaration of ip_set_destroy_set, With this path, the performance 
> degradation of ipset_swap is gone,

Thanks! I wrote the patch for the ipset package code and while it applies 
to the vanilla kernel source, function definiton ordering got broken. 
Sorry, I should have to double check.

> but my test only stress ipset_swap, not a swap/destroy sequence. I will 
> adjust my code to stress a full swap/destroy/create/add sequence, and 
> update later.

The synchronize_rcu() in ip_set_swap() was added to exclude the parallel 
swap+destroy and kernel side add/del/test operations, which can be tested 
with the commands

    ipset create hash_ip1 hash:net family inet hashsize 1024 maxelem 1048576
    ipset add hash_ip1 172.20.0.0/16
    ipset add hash_ip1 192.168.0.0/16
    iptables -A INPUT -m set --match-set hash_ip1 src -j ACCEPT
    while [ 1 ]
    do
            # ... Ongoing traffic...
            ipset create hash_ip2 hash:net family inet hashsize 1024 maxelem 1048576
            ipset add hash_ip2 172.20.0.0/16
            ipset swap hash_ip1 hash_ip2
            ipset destroy hash_ip2
            sleep 0.05
    done

I have checked it but the virtual machine on my dev laptop might be too 
slow to trigger the case.

Best regards,
Jozsef
-- 
E-mail  : kadlec@...ckhole.kfki.hu, kadlecsik.jozsef@...ner.hu
PGP key : https://wigner.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics
          H-1525 Budapest 114, POB. 49, Hungary