On Wed, Mar 26, 2014 at 12:20:46PM +0000, Patrick McHardy wrote:
> On Wed, Mar 12, 2014 at 05:18:00PM +0100, Pablo Neira Ayuso wrote:
> > On Fri, Mar 07, 2014 at 12:34:05PM +0100, Patrick McHardy wrote:
> > > We currently have a limit of 8 * PAGE_SIZE anonymous sets. Lift that limit
> > > by continuing the scan if the entire page is exhausted.
> > >
> > > Signed-off-by: Patrick McHardy <kaber@xxxxxxxxx>
> > > ---
> > > net/netfilter/nf_tables_api.c | 15 ++++++++++-----
> > > 1 file changed, 10 insertions(+), 5 deletions(-)
> > >
> > > diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> > > index f25d011..89d7ec4 100644
> > > --- a/net/netfilter/nf_tables_api.c
> > > +++ b/net/netfilter/nf_tables_api.c
> > > @@ -2004,7 +2004,7 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
> > > const struct nft_set *i;
> > > const char *p;
> > > unsigned long *inuse;
> > > - unsigned int n = 0;
> > > + unsigned int n = 0, min = 0;
> > >
> > > p = strnchr(name, IFNAMSIZ, '%');
> > > if (p != NULL) {
> > > @@ -2014,23 +2014,28 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
> > > inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
> > > if (inuse == NULL)
> > > return -ENOMEM;
> > > -
> > > +cont:
> > > list_for_each_entry(i, &ctx->table->sets, list) {
> > > int tmp;
> > >
> > > if (!sscanf(i->name, name, &tmp))
> > > continue;
> > > - if (tmp < 0 || tmp >= BITS_PER_BYTE * PAGE_SIZE)
> > > + if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
> >
> > I think we can break looping if tmp >= min + BITS_PER_BYTE * PAGE_SIZE
> > fulfills (assuming the list of sets is ordered).
>
> It's not, we really need to continue here.
>
> >
> > > continue;
> > >
> > > - set_bit(tmp, inuse);
> > > + set_bit(tmp - min, inuse);
> > > }
> > >
> > > n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
> > > + if (n >= BITS_PER_BYTE * PAGE_SIZE) {
> > > + min += BITS_PER_BYTE * PAGE_SIZE;
> > > + memset(inuse, 0, PAGE_SIZE);
> > > + goto cont;
> >
> > If the page is full, we start iterating over the set list from the
> > beginning.
>
> Yes, also necessary since the list is not ordered. We always pick the first
> free set name and add it at the end.
Right, I misunderstood the logic behind the patch. I'll push this
patch, thanks Patrick.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
