netfilter: xt_hashlimit: add a quota for each work

Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>

net/netfilter/xt_hashlimit.c

@@ -372,18 +372,24 @@ static bool select_gc(const struct xt_hashlimit_htable *ht,
 
 static void htable_selective_cleanup(struct xt_hashlimit_htable *ht,
 			bool (*select)(const struct xt_hashlimit_htable *ht,
-				      const struct dsthash_ent *he))
+				      const struct dsthash_ent *he),
+			unsigned int quota)
 {
-	unsigned int i;
+	unsigned int i, cnt = 0;
 
 	for (i = 0; i < ht->cfg.size; i++) {
 		struct dsthash_ent *dh;
 		struct hlist_node *n;
 
 		spin_lock_bh(&ht->lock);
 		hlist_for_each_entry_safe(dh, n, &ht->hash[i], node) {
-			if ((*select)(ht, dh))
+			if ((*select)(ht, dh)) {
 				dsthash_free(ht, dh);
+				if (quota != UINT_MAX && ++cnt >= quota) {
+					spin_unlock_bh(&ht->lock);
+					return;
+				}
+			}
 		}
 		spin_unlock_bh(&ht->lock);
 		cond_resched();
@@ -393,10 +399,12 @@ static void htable_selective_cleanup(struct xt_hashlimit_htable *ht,
 static void htable_gc(struct work_struct *work)
 {
 	struct xt_hashlimit_htable *ht;
+	unsigned int quota;
 
 	ht = container_of(work, struct xt_hashlimit_htable, gc_work.work);
 
-	htable_selective_cleanup(ht, select_gc);
+	quota = clamp_t(u32, ht->cfg.gc_interval, 1, 1000) * 1024;
+	htable_selective_cleanup(ht, select_gc, quota);
 
 	queue_delayed_work(system_power_efficient_wq,
 			   &ht->gc_work, msecs_to_jiffies(ht->cfg.gc_interval));
@@ -420,7 +428,7 @@ static void htable_destroy(struct xt_hashlimit_htable *hinfo)
 {
 	cancel_delayed_work_sync(&hinfo->gc_work);
 	htable_remove_proc_entry(hinfo);
-	htable_selective_cleanup(hinfo, select_all);
+	htable_selective_cleanup(hinfo, select_all, UINT_MAX);
 	kfree(hinfo->name);
 	vfree(hinfo);
 }