From 98d1bd802cdbc8f56868fae51edec13e86b59515 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Tue, 14 Jul 2015 17:51:06 +0200 Subject: netfilter: xtables: compute exact size needed for jumpstack The {arp,ip,ip6tables} jump stack is currently sized based on the number of user chains. However, its rather unlikely that every user defined chain jumps to the next, so lets use the existing loop detection logic to also track the chain depths. The stacksize is then set to the largest chain depth seen. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso --- net/netfilter/x_tables.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'net/netfilter/x_tables.c') diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c index d324fe71260c..4db7d60d42fa 100644 --- a/net/netfilter/x_tables.c +++ b/net/netfilter/x_tables.c @@ -749,6 +749,10 @@ static int xt_jumpstack_alloc(struct xt_table_info *i) if (i->jumpstack == NULL) return -ENOMEM; + /* ruleset without jumps -- no stack needed */ + if (i->stacksize == 0) + return 0; + i->stacksize *= xt_jumpstack_multiplier; size = sizeof(void *) * i->stacksize; for_each_possible_cpu(cpu) { -- cgit v1.2.3-55-g7522