netfilter: nf_conntrack: Reduce conntrack count in nf_conntrack_free()
authorEric Dumazet <dada1@cosmosbay.com>
Tue, 24 Mar 2009 13:26:50 +0000 (14:26 +0100)
committerPatrick McHardy <kaber@trash.net>
Tue, 24 Mar 2009 13:26:50 +0000 (14:26 +0100)
commit1d45209d89e647e9f27e4afa1f47338df73bc112
treea86c8e51811eafbedee01347b1a5c4e76d748b81
parentdd5b6ce6fd465eab90357711c8e8124dc3a31ff0
netfilter: nf_conntrack: Reduce conntrack count in nf_conntrack_free()

We use RCU to defer freeing of conntrack structures. In DOS situation, RCU might
accumulate about 10.000 elements per CPU in its internal queues. To get accurate
conntrack counts (at the expense of slightly more RAM used), we might consider
conntrack counter not taking into account "about to be freed elements, waiting
in RCU queues". We thus decrement it in nf_conntrack_free(), not in the RCU
callback.

Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
Tested-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
Signed-off-by: Patrick McHardy <kaber@trash.net>
net/netfilter/nf_conntrack_core.c