diff options
| author | Patrick McHardy <kaber@trash.net> | 2015-04-05 14:41:06 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2015-04-08 16:58:27 +0200 |
| commit | 3dd0673ac3cd7d05cde103396ec7ec410a901de2 (patch) | |
| tree | 4daf53c5aef7eade635652cd37c023fbd4e75bc1 /net/netfilter/nft_hash.c | |
| parent | 4a8678efbec6b0ea46baafb77cd297e6e02da933 (diff) | |
| download | linux-3dd0673ac3cd7d05cde103396ec7ec410a901de2.tar.gz | |
netfilter: nf_tables: prepare set element accounting for async updates
Use atomic operations for the element count to avoid races with async
updates.
To properly handle the transactional semantics during netlink updates,
deleted but not yet committed elements are accounted for seperately and
are treated as being already removed. This means for the duration of
a netlink transaction, the limit might be exceeded by the amount of
elements deleted. Set implementations must be prepared to handle this.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nft_hash.c')
| -rw-r--r-- | net/netfilter/nft_hash.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c index 5923ec54726898..c74e2bf1a1e44d 100644 --- a/net/netfilter/nft_hash.c +++ b/net/netfilter/nft_hash.c @@ -203,7 +203,7 @@ out: static void nft_hash_gc(struct work_struct *work) { - const struct nft_set *set; + struct nft_set *set; struct nft_hash_elem *he; struct nft_hash *priv; struct nft_set_gc_batch *gcb = NULL; @@ -237,6 +237,7 @@ static void nft_hash_gc(struct work_struct *work) if (gcb == NULL) goto out; rhashtable_remove_fast(&priv->ht, &he->node, nft_hash_params); + atomic_dec(&set->nelems); nft_set_gc_batch_add(gcb, he); } out: |