@@ -272,6 +272,7 @@ EXPORT_SYMBOL_GPL(nf_hook_entries_insert_raw);
*
* @old -- current hook blob at @pp
* @pp -- location of hook blob
+ * @recompile -- false if bpf prog should not be replaced
*
* Hook unregistration must always succeed, so to-be-removed hooks
* are replaced by a dummy one that will just move to next hook.
@@ -284,7 +285,8 @@ EXPORT_SYMBOL_GPL(nf_hook_entries_insert_raw);
* Returns address to free, or NULL.
*/
static void *__nf_hook_entries_try_shrink(struct nf_hook_entries *old,
- struct nf_hook_entries __rcu **pp)
+ struct nf_hook_entries __rcu **pp,
+ bool recompile)
{
unsigned int i, j, skip = 0, hook_entries;
struct bpf_prog *hook_bpf_prog = NULL;
@@ -329,10 +331,12 @@ static void *__nf_hook_entries_try_shrink(struct nf_hook_entries *old,
}
hooks_validate(new);
- /* if this fails fallback prog calls nf_hook_slow. */
- hook_bpf_prog = nf_hook_bpf_create(new);
- if (hook_bpf_prog)
- nf_hook_bpf_prog_set(new, hook_bpf_prog);
+ if (recompile) {
+ /* if this fails fallback prog calls nf_hook_slow. */
+ hook_bpf_prog = nf_hook_bpf_create(new);
+ if (hook_bpf_prog)
+ nf_hook_bpf_prog_set(new, hook_bpf_prog);
+ }
out_assign:
nf_hook_bpf_change_prog(NF_DISPATCHER_PTR, nf_hook_bpf_prog_get(old), hook_bpf_prog);
rcu_assign_pointer(*pp, new);
@@ -581,7 +585,7 @@ static void __nf_unregister_net_hook(struct net *net, int pf,
WARN_ONCE(1, "hook not found, pf %d num %d", pf, reg->hooknum);
}
- p = __nf_hook_entries_try_shrink(p, pp);
+ p = __nf_hook_entries_try_shrink(p, pp, check_net(net));
mutex_unlock(&nf_hook_mutex);
if (!p)
return;
@@ -612,7 +616,7 @@ void nf_hook_entries_delete_raw(struct nf_hook_entries __rcu **pp,
p = rcu_dereference_raw(*pp);
if (nf_remove_net_hook(p, reg)) {
- p = __nf_hook_entries_try_shrink(p, pp);
+ p = __nf_hook_entries_try_shrink(p, pp, false);
nf_hook_entries_free(p);
}
}
We can save a few cycles on netns destruction. When a hook is removed we can just skip building a new program with the remaining hooks, those will be removed too in the immediate future. Signed-off-by: Florian Westphal <fw@strlen.de> --- net/netfilter/core.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)