tree a86c8e51811eafbedee01347b1a5c4e76d748b81
parent dd5b6ce6fd465eab90357711c8e8124dc3a31ff0
author Eric Dumazet <dada1@cosmosbay.com> 1237901210 +0100
committer Patrick McHardy <kaber@trash.net> 1237901210 +0100

netfilter: nf_conntrack: Reduce conntrack count in nf_conntrack_free()

We use RCU to defer freeing of conntrack structures. In DOS situation, RCU might
accumulate about 10.000 elements per CPU in its internal queues. To get accurate
conntrack counts (at the expense of slightly more RAM used), we might consider
conntrack counter not taking into account "about to be freed elements, waiting
in RCU queues". We thus decrement it in nf_conntrack_free(), not in the RCU
callback.

Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
Tested-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
Signed-off-by: Patrick McHardy <kaber@trash.net>