target/linux/generic/backport-4.14/293-v4.16-netfilter-reduce-size-of-hook-entry-point-locations.patch

   1 From b0f38338aef2dae5ade3c16acf713737e3b15a73 Mon Sep 17 00:00:00 2001
   2 From: Florian Westphal <fw@strlen.de>
   3 Date: Sun, 3 Dec 2017 00:58:47 +0100
   4 Subject: [PATCH 05/11] netfilter: reduce size of hook entry point locations
   5
   6 struct net contains:
   7
   8 struct nf_hook_entries __rcu *hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
   9
  10 which store the hook entry point locations for the various protocol
  11 families and the hooks.
  12
  13 Using array results in compact c code when doing accesses, i.e.
  14   x = rcu_dereference(net->nf.hooks[pf][hook]);
  15
  16 but its also wasting a lot of memory, as most families are
  17 not used.
  18
  19 So split the array into those families that are used, which
  20 are only 5 (instead of 13).  In most cases, the 'pf' argument is
  21 constant, i.e. gcc removes switch statement.
  22
  23 struct net before:
  24  /* size: 5184, cachelines: 81, members: 46 */
  25 after:
  26  /* size: 4672, cachelines: 73, members: 46 */
  27
  28 Signed-off-by: Florian Westphal <fw@strlen.de>
  29 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  30 ---
  31  include/linux/netfilter.h       | 24 ++++++++++++++++++++++--
  32  include/net/netns/netfilter.h   |  6 +++++-
  33  net/bridge/br_netfilter_hooks.c |  2 +-
  34  net/netfilter/core.c            | 38 ++++++++++++++++++++++++++++++--------
  35  net/netfilter/nf_queue.c        | 21 +++++++++++++++++++--
  36  5 files changed, 77 insertions(+), 14 deletions(-)
  37
  38 --- a/include/linux/netfilter.h
  39 +++ b/include/linux/netfilter.h
  40 @@ -195,7 +195,7 @@ static inline int nf_hook(u_int8_t pf, u
  41                           struct net_device *indev, struct net_device *outdev,
  42                           int (*okfn)(struct net *, struct sock *, struct sk_buff *))
  43  {
  44 -       struct nf_hook_entries *hook_head;
  45 +       struct nf_hook_entries *hook_head = NULL;
  46         int ret = 1;
  47
  48  #ifdef HAVE_JUMP_LABEL
  49 @@ -206,7 +206,27 @@ static inline int nf_hook(u_int8_t pf, u
  50  #endif
  51
  52         rcu_read_lock();
  53 -       hook_head = rcu_dereference(net->nf.hooks[pf][hook]);
  54 +       switch (pf) {
  55 +       case NFPROTO_IPV4:
  56 +               hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]);
  57 +               break;
  58 +       case NFPROTO_IPV6:
  59 +               hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]);
  60 +               break;
  61 +       case NFPROTO_ARP:
  62 +               hook_head = rcu_dereference(net->nf.hooks_arp[hook]);
  63 +               break;
  64 +       case NFPROTO_BRIDGE:
  65 +               hook_head = rcu_dereference(net->nf.hooks_bridge[hook]);
  66 +               break;
  67 +       case NFPROTO_DECNET:
  68 +               hook_head = rcu_dereference(net->nf.hooks_decnet[hook]);
  69 +               break;
  70 +       default:
  71 +               WARN_ON_ONCE(1);
  72 +               break;
  73 +       }
  74 +
  75         if (hook_head) {
  76                 struct nf_hook_state state;
  77
  78 --- a/include/net/netns/netfilter.h
  79 +++ b/include/net/netns/netfilter.h
  80 @@ -17,7 +17,11 @@ struct netns_nf {
  81  #ifdef CONFIG_SYSCTL
  82         struct ctl_table_header *nf_log_dir_header;
  83  #endif
  84 -       struct nf_hook_entries __rcu *hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS];
  85 +       struct nf_hook_entries __rcu *hooks_ipv4[NF_MAX_HOOKS];
  86 +       struct nf_hook_entries __rcu *hooks_ipv6[NF_MAX_HOOKS];
  87 +       struct nf_hook_entries __rcu *hooks_arp[NF_MAX_HOOKS];
  88 +       struct nf_hook_entries __rcu *hooks_bridge[NF_MAX_HOOKS];
  89 +       struct nf_hook_entries __rcu *hooks_decnet[NF_MAX_HOOKS];
  90  #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
  91         bool                    defrag_ipv4;
  92  #endif
  93 --- a/net/bridge/br_netfilter_hooks.c
  94 +++ b/net/bridge/br_netfilter_hooks.c
  95 @@ -987,7 +987,7 @@ int br_nf_hook_thresh(unsigned int hook,
  96         unsigned int i;
  97         int ret;
  98
  99 -       e = rcu_dereference(net->nf.hooks[NFPROTO_BRIDGE][hook]);
 100 +       e = rcu_dereference(net->nf.hooks_bridge[hook]);
 101         if (!e)
 102                 return okfn(net, sk, skb);
 103
 104 --- a/net/netfilter/core.c
 105 +++ b/net/netfilter/core.c
 106 @@ -264,8 +264,23 @@ out_assign:
 107
 108  static struct nf_hook_entries __rcu **nf_hook_entry_head(struct net *net, const struct nf_hook_ops *reg)
 109  {
 110 -       if (reg->pf != NFPROTO_NETDEV)
 111 -               return net->nf.hooks[reg->pf]+reg->hooknum;
 112 +       switch (reg->pf) {
 113 +       case NFPROTO_NETDEV:
 114 +               break;
 115 +       case NFPROTO_ARP:
 116 +               return net->nf.hooks_arp + reg->hooknum;
 117 +       case NFPROTO_BRIDGE:
 118 +               return net->nf.hooks_bridge + reg->hooknum;
 119 +       case NFPROTO_IPV4:
 120 +               return net->nf.hooks_ipv4 + reg->hooknum;
 121 +       case NFPROTO_IPV6:
 122 +               return net->nf.hooks_ipv6 + reg->hooknum;
 123 +       case NFPROTO_DECNET:
 124 +               return net->nf.hooks_decnet + reg->hooknum;
 125 +       default:
 126 +               WARN_ON_ONCE(1);
 127 +               return NULL;
 128 +       }
 129
 130  #ifdef CONFIG_NETFILTER_INGRESS
 131         if (reg->hooknum == NF_NETDEV_INGRESS) {
 132 @@ -534,14 +549,21 @@ void (*nf_nat_decode_session_hook)(struc
 133  EXPORT_SYMBOL(nf_nat_decode_session_hook);
 134  #endif
 135
 136 -static int __net_init netfilter_net_init(struct net *net)
 137 +static void __net_init __netfilter_net_init(struct nf_hook_entries *e[NF_MAX_HOOKS])
 138  {
 139 -       int i, h;
 140 +       int h;
 141
 142 -       for (i = 0; i < ARRAY_SIZE(net->nf.hooks); i++) {
 143 -               for (h = 0; h < NF_MAX_HOOKS; h++)
 144 -                       RCU_INIT_POINTER(net->nf.hooks[i][h], NULL);
 145 -       }
 146 +       for (h = 0; h < NF_MAX_HOOKS; h++)
 147 +               RCU_INIT_POINTER(e[h], NULL);
 148 +}
 149 +
 150 +static int __net_init netfilter_net_init(struct net *net)
 151 +{
 152 +       __netfilter_net_init(net->nf.hooks_ipv4);
 153 +       __netfilter_net_init(net->nf.hooks_ipv6);
 154 +       __netfilter_net_init(net->nf.hooks_arp);
 155 +       __netfilter_net_init(net->nf.hooks_bridge);
 156 +       __netfilter_net_init(net->nf.hooks_decnet);
 157
 158  #ifdef CONFIG_PROC_FS
 159         net->nf.proc_netfilter = proc_net_mkdir(net, "netfilter",
 160 --- a/net/netfilter/nf_queue.c
 161 +++ b/net/netfilter/nf_queue.c
 162 @@ -201,6 +201,23 @@ repeat:
 163         return NF_ACCEPT;
 164  }
 165
 166 +static struct nf_hook_entries *nf_hook_entries_head(const struct net *net, u8 pf, u8 hooknum)
 167 +{
 168 +       switch (pf) {
 169 +       case NFPROTO_BRIDGE:
 170 +               return rcu_dereference(net->nf.hooks_bridge[hooknum]);
 171 +       case NFPROTO_IPV4:
 172 +               return rcu_dereference(net->nf.hooks_ipv4[hooknum]);
 173 +       case NFPROTO_IPV6:
 174 +               return rcu_dereference(net->nf.hooks_ipv6[hooknum]);
 175 +       default:
 176 +               WARN_ON_ONCE(1);
 177 +               return NULL;
 178 +       }
 179 +
 180 +       return NULL;
 181 +}
 182 +
 183  /* Caller must hold rcu read-side lock */
 184  void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
 185  {
 186 @@ -216,12 +233,12 @@ void nf_reinject(struct nf_queue_entry *
 187         net = entry->state.net;
 188         pf = entry->state.pf;
 189
 190 -       hooks = rcu_dereference(net->nf.hooks[pf][entry->state.hook]);
 191 +       hooks = nf_hook_entries_head(net, pf, entry->state.hook);
 192
 193         nf_queue_entry_release_refs(entry);
 194
 195         i = entry->hook_index;
 196 -       if (WARN_ON_ONCE(i >= hooks->num_hook_entries)) {
 197 +       if (WARN_ON_ONCE(!hooks || i >= hooks->num_hook_entries)) {
 198                 kfree_skb(skb);
 199                 kfree(entry);
 200                 return;