• Anders K. Pedersen's avatar
    netfilter: nf_tables: fix inconsistent element expiration calculation · d3e2a111
    Anders K. Pedersen authored
    As Liping Zhang reports, after commit a8b1e36d ("netfilter: nft_dynset:
    fix element timeout for HZ != 1000"), priv->timeout was stored in jiffies,
    while set->timeout was stored in milliseconds. This is inconsistent and
    incorrect.
    
    Firstly, we already call msecs_to_jiffies in nft_set_elem_init, so
    priv->timeout will be converted to jiffies twice.
    
    Secondly, if the user did not specify the NFTA_DYNSET_TIMEOUT attr,
    set->timeout will be used, but we forget to call msecs_to_jiffies
    when do update elements.
    
    Fix this by using jiffies internally for traditional sets and doing the
    conversions to/from msec when interacting with userspace - as dynset
    already does.
    
    This is preferable to doing the conversions, when elements are inserted or
    updated, because this can happen very frequently on busy dynsets.
    
    Fixes: a8b1e36d ("netfilter: nft_dynset: fix element timeout for HZ != 1000")
    Reported-by: default avatarLiping Zhang <zlpnobody@gmail.com>
    Signed-off-by: default avatarAnders K. Pedersen <akp@cohaesio.com>
    Acked-by: default avatarLiping Zhang <zlpnobody@gmail.com>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    d3e2a111
nf_tables_api.c 117 KB