提交 bb1d23b0 编写于 作者: E Eric Dumazet 提交者: David S. Miller

[IPV4]: Bug fix in rt_check_expire()

- rt_check_expire() fixes (an overflow occured if size of the hash
  was >= 65536)

reminder of the bugfix:

The rt_check_expire() has a serious problem on machines with large
route caches, and a standard HZ value of 1000.

With default values, ie ip_rt_gc_interval = 60*HZ = 60000 ;

the loop count :

     for (t = ip_rt_gc_interval << rt_hash_log; t >= 0;


overflows (t is a 31 bit value) as soon rt_hash_log is >= 16  (65536
slots in route cache hash table).

In this case, rt_check_expire() does nothing at all
Signed-off-by: NEric Dumazet <dada1@cosmosbay.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 424c4b70
...@@ -54,7 +54,7 @@ ...@@ -54,7 +54,7 @@
* Marc Boucher : routing by fwmark * Marc Boucher : routing by fwmark
* Robert Olsson : Added rt_cache statistics * Robert Olsson : Added rt_cache statistics
* Arnaldo C. Melo : Convert proc stuff to seq_file * Arnaldo C. Melo : Convert proc stuff to seq_file
* Eric Dumazet : hashed spinlocks * Eric Dumazet : hashed spinlocks and rt_check_expire() fixes.
* *
* This program is free software; you can redistribute it and/or * This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License * modify it under the terms of the GNU General Public License
...@@ -606,18 +606,25 @@ static struct rtable **rt_remove_balanced_route(struct rtable **chain_head, ...@@ -606,18 +606,25 @@ static struct rtable **rt_remove_balanced_route(struct rtable **chain_head,
/* This runs via a timer and thus is always in BH context. */ /* This runs via a timer and thus is always in BH context. */
static void rt_check_expire(unsigned long dummy) static void rt_check_expire(unsigned long dummy)
{ {
static int rover; static unsigned int rover;
int i = rover, t; unsigned int i = rover, goal;
struct rtable *rth, **rthp; struct rtable *rth, **rthp;
unsigned long now = jiffies; unsigned long now = jiffies;
u64 mult;
for (t = ip_rt_gc_interval << rt_hash_log; t >= 0;
t -= ip_rt_gc_timeout) { mult = ((u64)ip_rt_gc_interval) << rt_hash_log;
if (ip_rt_gc_timeout > 1)
do_div(mult, ip_rt_gc_timeout);
goal = (unsigned int)mult;
if (goal > rt_hash_mask) goal = rt_hash_mask + 1;
for (; goal > 0; goal--) {
unsigned long tmo = ip_rt_gc_timeout; unsigned long tmo = ip_rt_gc_timeout;
i = (i + 1) & rt_hash_mask; i = (i + 1) & rt_hash_mask;
rthp = &rt_hash_table[i].chain; rthp = &rt_hash_table[i].chain;
if (*rthp == 0)
continue;
spin_lock(rt_hash_lock_addr(i)); spin_lock(rt_hash_lock_addr(i));
while ((rth = *rthp) != NULL) { while ((rth = *rthp) != NULL) {
if (rth->u.dst.expires) { if (rth->u.dst.expires) {
...@@ -658,7 +665,7 @@ static void rt_check_expire(unsigned long dummy) ...@@ -658,7 +665,7 @@ static void rt_check_expire(unsigned long dummy)
break; break;
} }
rover = i; rover = i;
mod_timer(&rt_periodic_timer, now + ip_rt_gc_interval); mod_timer(&rt_periodic_timer, jiffies + ip_rt_gc_interval);
} }
/* This can run from both BH and non-BH contexts, the latter /* This can run from both BH and non-BH contexts, the latter
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册