Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

Pablo Neira Ayuso says:

====================
netfilter updates for net-next

The following patchset contains netfilter updates for net-next, just a
bunch of cleanups and small enhancement to selectively flush conntracks
in ctnetlink, more specifically the patches are:

1) Rise default number of buckets in conntrack from 16384 to 65536 in
   systems with >= 4GBytes, patch from Marcelo Leitner.

2) Small refactor to save one level on indentation in xt_osf, from
   Joe Perches.

3) Remove unnecessary sizeof(char) in nf_log, from Fabian Frederick.

4) Another small cleanup to remove redundant variable in nfnetlink,
   from Duan Jiong.

5) Fix compilation warning in nfnetlink_cthelper on parisc, from
   Chen Gang.

6) Fix wrong format in debugging for ctseqadj, from Gao feng.

7) Selective conntrack flushing through the mark for ctnetlink, patch
   from Kristian Evensen.

8) Remove nf_ct_conntrack_flush_report() exported symbol now that is
   not required anymore after the selective flushing patch, again from
   Kristian.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

diff --combined net/netfilter/nf_conntrack_core.c
index 46d1b26,5a6990b..13fad86
--- 1/net/netfilter/nf_conntrack_core.c
--- 2/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@@ -611,15 -611,16 +611,15 @@@ __nf_conntrack_confirm(struct sk_buff *
         */
        NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
        pr_debug("Confirming conntrack %p\n", ct);
 -      /* We have to check the DYING flag inside the lock to prevent
 -         a race against nf_ct_get_next_corpse() possibly called from
 -         user context, else we insert an already 'dead' hash, blocking
 -         further use of that particular connection -JM */
 -
 -      if (unlikely(nf_ct_is_dying(ct))) {
 -              nf_conntrack_double_unlock(hash, reply_hash);
 -              local_bh_enable();
 -              return NF_ACCEPT;
 -      }
 +      /* We have to check the DYING flag after unlink to prevent
 +       * a race against nf_ct_get_next_corpse() possibly called from
 +       * user context, else we insert an already 'dead' hash, blocking
 +       * further use of that particular connection -JM.
 +       */
 +      nf_ct_del_from_dying_or_unconfirmed_list(ct);
 +
 +      if (unlikely(nf_ct_is_dying(ct)))
 +              goto out;
  
        /* See if there's one in the list already, including reverse:
           NAT could have grabbed it without realizing, since we're
@@@ -635,6 -636,8 +635,6 @@@
                    zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
                        goto out;
  
 -      nf_ct_del_from_dying_or_unconfirmed_list(ct);
 -
        /* Timer relative to confirmation time, not original
           setting time, otherwise we'd get timer wrap in
           weird delay cases. */
@@@ -670,7 -673,6 +670,7 @@@
        return NF_ACCEPT;
  
  out:
 +      nf_ct_add_to_dying_list(ct);
        nf_conntrack_double_unlock(hash, reply_hash);
        NF_CT_STAT_INC(net, insert_failed);
        local_bh_enable();
@@@ -1424,12 -1426,6 +1424,6 @@@ void nf_ct_free_hashtable(void *hash, u
  }
  EXPORT_SYMBOL_GPL(nf_ct_free_hashtable);
  
- void nf_conntrack_flush_report(struct net *net, u32 portid, int report)
- {
-       nf_ct_iterate_cleanup(net, kill_all, NULL, portid, report);
- }
- EXPORT_SYMBOL_GPL(nf_conntrack_flush_report);
- 
  static int untrack_refs(void)
  {
        int cnt = 0, cpu;
@@@ -1622,13 -1618,18 +1616,18 @@@ int nf_conntrack_init_start(void
        for (i = 0; i < CONNTRACK_LOCKS; i++)
                spin_lock_init(&nf_conntrack_locks[i]);
  
-       /* Idea from tcp.c: use 1/16384 of memory.  On i386: 32MB
-        * machine has 512 buckets. >= 1GB machines have 16384 buckets. */
        if (!nf_conntrack_htable_size) {
+               /* Idea from tcp.c: use 1/16384 of memory.
+                * On i386: 32MB machine has 512 buckets.
+                * >= 1GB machines have 16384 buckets.
+                * >= 4GB machines have 65536 buckets.
+                */
                nf_conntrack_htable_size
                        = (((totalram_pages << PAGE_SHIFT) / 16384)
                           / sizeof(struct hlist_head));
-               if (totalram_pages > (1024 * 1024 * 1024 / PAGE_SIZE))
+               if (totalram_pages > (4 * (1024 * 1024 * 1024 / PAGE_SIZE)))
+                       nf_conntrack_htable_size = 65536;
+               else if (totalram_pages > (1024 * 1024 * 1024 / PAGE_SIZE))
                        nf_conntrack_htable_size = 16384;
                if (nf_conntrack_htable_size < 32)
                        nf_conntrack_htable_size = 32;

diff --combined net/netfilter/nfnetlink.c
index c421d94,a7a7e82..8b117c9
--- 1/net/netfilter/nfnetlink.c
--- 2/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@@ -272,7 -272,7 +272,7 @@@ static void nfnl_err_deliver(struct lis
  static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
                                u_int16_t subsys_id)
  {
-       struct sk_buff *nskb, *oskb = skb;
+       struct sk_buff *oskb = skb;
        struct net *net = sock_net(skb->sk);
        const struct nfnetlink_subsystem *ss;
        const struct nfnl_callback *nc;
@@@ -283,12 -283,11 +283,11 @@@
        if (subsys_id >= NFNL_SUBSYS_COUNT)
                return netlink_ack(skb, nlh, -EINVAL);
  replay:
-       nskb = netlink_skb_clone(oskb, GFP_KERNEL);
-       if (!nskb)
+       skb = netlink_skb_clone(oskb, GFP_KERNEL);
+       if (!skb)
                return netlink_ack(oskb, nlh, -ENOMEM);
  
-       nskb->sk = oskb->sk;
-       skb = nskb;
+       skb->sk = oskb->sk;
  
        nfnl_lock(subsys_id);
        ss = rcu_dereference_protected(table[subsys_id].subsys,
@@@ -305,7 -304,7 +304,7 @@@
                {
                        nfnl_unlock(subsys_id);
                        netlink_ack(skb, nlh, -EOPNOTSUPP);
-                       return kfree_skb(nskb);
+                       return kfree_skb(skb);
                }
        }
  
@@@ -321,8 -320,7 +320,8 @@@
                nlh = nlmsg_hdr(skb);
                err = 0;
  
 -              if (nlh->nlmsg_len < NLMSG_HDRLEN) {
 +              if (nlmsg_len(nlh) < sizeof(struct nfgenmsg) ||
 +                  skb->len < nlh->nlmsg_len) {
                        err = -EINVAL;
                        goto ack;
                }
@@@ -386,7 -384,7 +385,7 @@@
                                nfnl_err_reset(&err_list);
                                ss->abort(oskb);
                                nfnl_unlock(subsys_id);
-                               kfree_skb(nskb);
+                               kfree_skb(skb);
                                goto replay;
                        }
                }
@@@ -427,7 -425,7 +426,7 @@@ done
  
        nfnl_err_deliver(&err_list, oskb);
        nfnl_unlock(subsys_id);
-       kfree_skb(nskb);
+       kfree_skb(skb);
  }
  
  static void nfnetlink_rcv(struct sk_buff *skb)
@@@ -464,13 -462,13 +463,13 @@@
  }
  
  #ifdef CONFIG_MODULES
 -static int nfnetlink_bind(int group)
 +static int nfnetlink_bind(struct net *net, int group)
  {
        const struct nfnetlink_subsystem *ss;
        int type;
  
        if (group <= NFNLGRP_NONE || group > NFNLGRP_MAX)
 -              return -EINVAL;
 +              return 0;
  
        type = nfnl_group2type[group];