diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2018-09-04 12:07:55 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2018-09-17 16:11:03 +0200 |
| commit | 0d704967f4a49cc2212350b3e4a8231f8b4283ed (patch) | |
| tree | 2c0f3f080856e140599b8bee959019f3e6a113b9 /include | |
| parent | 59c08c69c2788612f1afd199c5c87d9df8b8a356 (diff) | |
| download | linux-0d704967f4a49cc2212350b3e4a8231f8b4283ed.tar.gz linux-0d704967f4a49cc2212350b3e4a8231f8b4283ed.tar.bz2 linux-0d704967f4a49cc2212350b3e4a8231f8b4283ed.zip | |
netfilter: xt_cgroup: shrink size of v2 path
cgroup v2 path field is PATH_MAX which is too large, this is placing too
much pressure on memory allocation for people with many rules doing
cgroup v1 classid matching, side effects of this are bug reports like:
https://bugzilla.kernel.org/show_bug.cgi?id=200639
This patch registers a new revision that shrinks the cgroup path to 512
bytes, which is the same approach we follow in similar extensions that
have a path field.
Cc: Tejun Heo <tj@kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Acked-by: Tejun Heo <tj@kernel.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/uapi/linux/netfilter/xt_cgroup.h | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/include/uapi/linux/netfilter/xt_cgroup.h b/include/uapi/linux/netfilter/xt_cgroup.h index e96dfa1b34f7..b74e370d6133 100644 --- a/include/uapi/linux/netfilter/xt_cgroup.h +++ b/include/uapi/linux/netfilter/xt_cgroup.h @@ -22,4 +22,20 @@ struct xt_cgroup_info_v1 { void *priv __attribute__((aligned(8))); }; +#define XT_CGROUP_PATH_MAX 512 + +struct xt_cgroup_info_v2 { + __u8 has_path; + __u8 has_classid; + __u8 invert_path; + __u8 invert_classid; + union { + char path[XT_CGROUP_PATH_MAX]; + __u32 classid; + }; + + /* kernel internal data */ + void *priv __attribute__((aligned(8))); +}; + #endif /* _UAPI_XT_CGROUP_H */ |