netdev - Re: [PATCH] netfilter: nf_conntrack: Batch cleanup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5146DF4E.9030609@cn.fujitsu.com>
Date:	Mon, 18 Mar 2013 17:33:02 +0800
From:	Gao feng <gaofeng@...fujitsu.com>
To:	Vladimir Davydov <vdavydov@...allels.com>
CC:	Pablo Neira Ayuso <pablo@...filter.org>,
	netfilter-devel@...r.kernel.org, netfilter@...r.kernel.org,
	coreteam@...filter.org, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org, devel@...nvz.org,
	Patrick McHardy <kaber@...sh.net>,
	"David S. Miller" <davem@...emloft.net>,
	"Eric W. Biederman" <ebiederm@...ssion.com>
Subject: Re: [PATCH] netfilter: nf_conntrack: Batch cleanup

On 2013/03/14 17:40, Vladimir Davydov wrote:
> The patch introduces nf_conntrack_cleanup_net_list(), which cleanups
> nf_conntrack for a list of netns and calls synchronize_net() only once
> for them all. This should reduce netns destruction time.
> --
> I've measured cleanup time for 1k dummy net ns. Here are the results:
> 
>  <without the patch>
>  # modprobe nf_conntrack
>  # time modprobe -r nf_conntrack
> 
>  real	0m10.337s
>  user	0m0.000s
>  sys	0m0.376s
> 
>  <with the patch>
>  # modprobe nf_conntrack
>  # time modprobe -r nf_conntrack
> 
>  real    0m5.661s
>  user    0m0.000s
>  sys     0m0.216s
> 
> Signed-off-by: Vladimir Davydov <vdavydov@...allels.com>
> Cc: Patrick McHardy <kaber@...sh.net>
> Cc: "David S. Miller" <davem@...emloft.net>
> Cc: "Eric W. Biederman" <ebiederm@...ssion.com>
> ---
>  include/net/netfilter/nf_conntrack_core.h |    1 +
>  net/netfilter/nf_conntrack_core.c         |   46 ++++++++++++++++++++---------
>  net/netfilter/nf_conntrack_standalone.c   |   16 ++++++----
>  3 files changed, 43 insertions(+), 20 deletions(-)
> 
> diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
> index 930275f..fb2b623 100644
> --- a/include/net/netfilter/nf_conntrack_core.h
> +++ b/include/net/netfilter/nf_conntrack_core.h
> @@ -27,6 +27,7 @@ extern unsigned int nf_conntrack_in(struct net *net,
>  
>  extern int nf_conntrack_init_net(struct net *net);
>  extern void nf_conntrack_cleanup_net(struct net *net);
> +extern void nf_conntrack_cleanup_net_list(struct list_head *net_exit_list);
>  
>  extern int nf_conntrack_proto_pernet_init(struct net *net);
>  extern void nf_conntrack_proto_pernet_fini(struct net *net);
> diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
> index c8e001a..09c02ef 100644
> --- a/net/netfilter/nf_conntrack_core.c
> +++ b/net/netfilter/nf_conntrack_core.c
> @@ -1364,30 +1364,48 @@ void nf_conntrack_cleanup_end(void)
>   */
>  void nf_conntrack_cleanup_net(struct net *net)
>  {
> +	LIST_HEAD(single);
> +
> +	list_add(&net->exit_list, &single);
> +	nf_conntrack_cleanup_net_list(&single);
> +}
> +

After adding net->exit_list to this single list,in setup_net we will
re-add this net->exit_list to net_exit_list. So there has no invalid
pointer problem.

This patch looks good to me.
Acked-by: Gao feng <gaofeng@...fujitsu.com>

Thanks!
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html