This is a note to let you know that I've just added the patch titled
netfilter: nf_tables: do not remove elements if set backend implements .abort
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netfilter-nf_tables-do-not-remove-elements-if-set-ba.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit 0099073d67d434c3e9140697d9c99182ce276fa3
Author: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Date: Wed Oct 4 13:12:58 2023 +0200
netfilter: nf_tables: do not remove elements if set backend implements .abort
[ Upstream commit ebd032fa881882fef2acb9da1bbde48d8233241d ]
pipapo set backend maintains two copies of the datastructure, removing
the elements from the copy that is going to be discarded slows down
the abort path significantly, from several minutes to few seconds after
this patch.
Fixes: 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol")
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 8a4cd1c16e0e4..cd4318cbcaa39 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -9713,7 +9713,10 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
break;
}
te = (struct nft_trans_elem *)trans->data;
- nft_setelem_remove(net, te->set, &te->elem);
+ if (!te->set->ops->abort ||
+ nft_setelem_is_catchall(te->set, &te->elem))
+ nft_setelem_remove(net, te->set, &te->elem);
+
if (!nft_setelem_is_catchall(te->set, &te->elem))
atomic_dec(&te->set->nelems);
