summaryrefslogtreecommitdiffstats
path: root/src/rule.c
diff options
context:
space:
mode:
authorLiping Zhang <zlpnobody@gmail.com>2017-05-14 15:56:12 +0800
committerPablo Neira Ayuso <pablo@netfilter.org>2017-05-17 18:33:40 +0200
commita4af1e9b7e5ab4c98f3e338a4552ba2017b5c381 (patch)
tree2478f35e7cacc3bb996d2ac7eea38bc985a72f24 /src/rule.c
parenta9dc3ceabc10f3bf43c7e9edc6d4a35ef3aa2358 (diff)
src: delete the old cache when dumping is interrupted
When the dumping operation is interrupted, we will restart the cache_init(), but unfortunatly, we forget to delete the old cache. So in extreme case, we will leak a huge amount of memory. Running the following commands can simulate the extreme case: # nft add table t # nft add set t s {type inet_service \;} # for i in $(seq 65000); do nft add element t s {$i} done & # while : ; do time nft list ruleset -nn done After a while, oom killer will be triggered: [ 2808.243537] Out of memory: Kill process 16975 (nft) score 649 or sacrifice child [ 2808.255372] Killed process 16975 (nft) total-vm:1955348kB, anon-rss:1952120kB, file-rss:0kB, shmem-rss:0kB [ 2858.353729] nft invoked oom-killer: gfp_mask=0x14201ca(GFP_HIGHUSER_ MOVABLE|__GFP_COLD), nodemask=(null), order=0, oom_score_adj=0 [ 2858.374521] nft cpuset=/ mems_allowed=0 ... Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/rule.c')
-rw-r--r--src/rule.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/rule.c b/src/rule.c
index 209cf2d7..5923bf64 100644
--- a/src/rule.c
+++ b/src/rule.c
@@ -156,11 +156,11 @@ replay:
netlink_genid_get();
ret = cache_init(cmd, msgs);
if (ret < 0) {
+ cache_release();
if (errno == EINTR) {
netlink_restart();
goto replay;
}
- cache_release();
return -1;
}
cache_initialized = true;