From 698bb828a6c20c86e30b307175be1827c071ce23 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Fri, 14 Apr 2023 15:01:32 +0200 Subject: netfilter: nf_tables: do not store pktinfo in traceinfo structure pass it as argument. No change in object size. stack usage decreases by 8 byte: nf_tables_core.c:254 nft_do_chain 320 static Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_tables.h | 5 ++--- net/netfilter/nf_tables_core.c | 21 ++++++++++++--------- net/netfilter/nf_tables_trace.c | 5 ++--- 3 files changed, 16 insertions(+), 15 deletions(-) diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index ec347d9cff9e..cab351928cd2 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -1408,7 +1408,6 @@ void nft_unregister_flowtable_type(struct nf_flowtable_type *type); * @type: event type (enum nft_trace_types) * @skbid: hash of skb to be used as trace id * @packet_dumped: packet headers sent in a previous traceinfo message - * @pkt: pktinfo currently processed * @basechain: base chain currently processed * @rule: rule that was evaluated * @verdict: verdict given by rule @@ -1419,7 +1418,6 @@ struct nft_traceinfo { bool packet_dumped; enum nft_trace_types type:8; u32 skbid; - const struct nft_pktinfo *pkt; const struct nft_base_chain *basechain; const struct nft_rule_dp *rule; const struct nft_verdict *verdict; @@ -1429,7 +1427,8 @@ void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt, const struct nft_verdict *verdict, const struct nft_chain *basechain); -void nft_trace_notify(struct nft_traceinfo *info); +void nft_trace_notify(const struct nft_pktinfo *pkt, + struct nft_traceinfo *info); #define MODULE_ALIAS_NFT_CHAIN(family, name) \ MODULE_ALIAS("nft-chain-" __stringify(family) "-" name) diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c index bed855638050..776eb2b9f632 100644 --- a/net/netfilter/nf_tables_core.c +++ b/net/netfilter/nf_tables_core.c @@ -41,7 +41,8 @@ static inline bool nf_skip_indirect_calls(void) { return false; } static inline void nf_skip_indirect_calls_enable(void) { } #endif -static noinline void __nft_trace_packet(struct nft_traceinfo *info, +static noinline void __nft_trace_packet(const struct nft_pktinfo *pkt, + struct nft_traceinfo *info, enum nft_trace_types type) { if (!info->trace || !info->nf_trace) @@ -49,7 +50,7 @@ static noinline void __nft_trace_packet(struct nft_traceinfo *info, info->type = type; - nft_trace_notify(info); + nft_trace_notify(pkt, info); } static inline void nft_trace_packet(const struct nft_pktinfo *pkt, @@ -60,7 +61,7 @@ static inline void nft_trace_packet(const struct nft_pktinfo *pkt, if (static_branch_unlikely(&nft_trace_enabled)) { info->nf_trace = pkt->skb->nf_trace; info->rule = rule; - __nft_trace_packet(info, type); + __nft_trace_packet(pkt, info, type); } } @@ -105,7 +106,8 @@ static void nft_cmp16_fast_eval(const struct nft_expr *expr, regs->verdict.code = NFT_BREAK; } -static noinline void __nft_trace_verdict(struct nft_traceinfo *info, +static noinline void __nft_trace_verdict(const struct nft_pktinfo *pkt, + struct nft_traceinfo *info, const struct nft_regs *regs) { enum nft_trace_types type; @@ -123,20 +125,21 @@ static noinline void __nft_trace_verdict(struct nft_traceinfo *info, type = NFT_TRACETYPE_RULE; if (info->trace) - info->nf_trace = info->pkt->skb->nf_trace; + info->nf_trace = pkt->skb->nf_trace; break; } - __nft_trace_packet(info, type); + __nft_trace_packet(pkt, info, type); } -static inline void nft_trace_verdict(struct nft_traceinfo *info, +static inline void nft_trace_verdict(const struct nft_pktinfo *pkt, + struct nft_traceinfo *info, const struct nft_rule_dp *rule, const struct nft_regs *regs) { if (static_branch_unlikely(&nft_trace_enabled)) { info->rule = rule; - __nft_trace_verdict(info, regs); + __nft_trace_verdict(pkt, info, regs); } } @@ -300,7 +303,7 @@ next_rule: break; } - nft_trace_verdict(&info, rule, ®s); + nft_trace_verdict(pkt, &info, rule, ®s); switch (regs.verdict.code & NF_VERDICT_MASK) { case NF_ACCEPT: diff --git a/net/netfilter/nf_tables_trace.c b/net/netfilter/nf_tables_trace.c index 3d9b83d84a84..0a0dcf2587fd 100644 --- a/net/netfilter/nf_tables_trace.c +++ b/net/netfilter/nf_tables_trace.c @@ -183,9 +183,9 @@ static const struct nft_chain *nft_trace_get_chain(const struct nft_traceinfo *i return last->chain; } -void nft_trace_notify(struct nft_traceinfo *info) +void nft_trace_notify(const struct nft_pktinfo *pkt, + struct nft_traceinfo *info) { - const struct nft_pktinfo *pkt = info->pkt; const struct nft_chain *chain; struct nlmsghdr *nlh; struct sk_buff *skb; @@ -305,7 +305,6 @@ void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt, info->trace = true; info->nf_trace = pkt->skb->nf_trace; info->packet_dumped = false; - info->pkt = pkt; info->verdict = verdict; net_get_random_once(&trace_key, sizeof(trace_key)); -- cgit v1.2.3