| Message ID | 20250403115752.19608-2-pablo@netfilter.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 9d74da1177c800eb3d51c13f9821b7b0683845a5 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,1/3] netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only | expand |
Hello: This series was applied to netdev/net.git (main) by Pablo Neira Ayuso <pablo@netfilter.org>: On Thu, 3 Apr 2025 13:57:50 +0200 you wrote: > conncount has its own GC handler which determines when to reap stale > elements, this is convenient for dynamic sets. However, this also reaps > non-dynamic sets with static configurations coming from control plane. > Always run connlimit gc handler but honor feedback to reap element if > this set is dynamic. > > Fixes: 290180e2448c ("netfilter: nf_tables: add connlimit support") > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> > > [...] Here is the summary with links: - [net,1/3] netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only https://git.kernel.org/netdev/net/c/9d74da1177c8 - [net,2/3] netfilter: nf_tables: don't unregister hook when table is dormant https://git.kernel.org/netdev/net/c/688c15017d5c - [net,3/3] netfilter: nft_tunnel: fix geneve_opt type confusion addition https://git.kernel.org/netdev/net/c/1b755d8eb1ac You are awesome, thank you!
diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c index 8bfac4185ac7..abb0c8ec6371 100644 --- a/net/netfilter/nft_set_hash.c +++ b/net/netfilter/nft_set_hash.c @@ -309,7 +309,8 @@ static bool nft_rhash_expr_needs_gc_run(const struct nft_set *set, nft_setelem_expr_foreach(expr, elem_expr, size) { if (expr->ops->gc && - expr->ops->gc(read_pnet(&set->net), expr)) + expr->ops->gc(read_pnet(&set->net), expr) && + set->flags & NFT_SET_EVAL) return true; }
conncount has its own GC handler which determines when to reap stale elements, this is convenient for dynamic sets. However, this also reaps non-dynamic sets with static configurations coming from control plane. Always run connlimit gc handler but honor feedback to reap element if this set is dynamic. Fixes: 290180e2448c ("netfilter: nf_tables: add connlimit support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- net/netfilter/nft_set_hash.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)