netfilter: nf_conntrack: use safer way to lock all buckets

Browse source

When we need to lock all buckets in the connection hashtable we'd attempt to
lock 1024 spinlocks, which is way more preemption levels than supported by
the kernel. Furthermore, this behavior was hidden by checking if lockdep is
enabled, and if it was - use only 8 buckets(!).

Fix this by using a global lock and synchronize all buckets on it when we
need to lock them all. This is pretty heavyweight, but is only done when we
need to resize the hashtable, and that doesn't happen often enough (or at all).

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Sasha Levin 2016-01-18 19:23:51 -05:00 • committed by Pablo Neira Ayuso

parent 35b815392a

commit b16c29191d

5 changed files with 35 additions and 19 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

8

include/net/netfilter/nf_conntrack_core.h

View file

38

net/netfilter/nf_conntrack_core.c

View file

2

net/netfilter/nf_conntrack_helper.c

View file

2

net/netfilter/nf_conntrack_netlink.c

View file

4

net/netfilter/nfnetlink_cttimeout.c

View file