inet: frag: set limits and make init_net's high_thresh limit global
This patch makes init_net's high_thresh limit to be the maximum for all namespaces, thus introducing a global memory limit threshold equal to the sum of the individual high_thresh limits which are capped. It also introduces some sane minimums for low_thresh as it shouldn't be able to drop below 0 (or > high_thresh in the unsigned case), and overall low_thresh should not ever be above high_thresh, so we make the following relations for a namespace: init_net: high_thresh - max(not capped), min(init_net low_thresh) low_thresh - max(init_net high_thresh), min (0) all other namespaces: high_thresh = max(init_net high_thresh), min(namespace's low_thresh) low_thresh = max(namespace's high_thresh), min(0) The major issue with having low_thresh > high_thresh is that we'll schedule eviction but never evict anything and thus rely only on the timers. Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
ab1c724f63
commit
1bab4c7507
@ -101,7 +101,8 @@ ipfrag_high_thresh - INTEGER
|
|||||||
Maximum memory used to reassemble IP fragments. When
|
Maximum memory used to reassemble IP fragments. When
|
||||||
ipfrag_high_thresh bytes of memory is allocated for this purpose,
|
ipfrag_high_thresh bytes of memory is allocated for this purpose,
|
||||||
the fragment handler will toss packets until ipfrag_low_thresh
|
the fragment handler will toss packets until ipfrag_low_thresh
|
||||||
is reached.
|
is reached. This also serves as a maximum limit to namespaces
|
||||||
|
different from the initial one.
|
||||||
|
|
||||||
ipfrag_low_thresh - INTEGER
|
ipfrag_low_thresh - INTEGER
|
||||||
Maximum memory used to reassemble IP fragments before the kernel
|
Maximum memory used to reassemble IP fragments before the kernel
|
||||||
|
@ -386,20 +386,25 @@ int lowpan_frag_rcv(struct sk_buff *skb, const u8 frag_type)
|
|||||||
EXPORT_SYMBOL(lowpan_frag_rcv);
|
EXPORT_SYMBOL(lowpan_frag_rcv);
|
||||||
|
|
||||||
#ifdef CONFIG_SYSCTL
|
#ifdef CONFIG_SYSCTL
|
||||||
|
static int zero;
|
||||||
|
|
||||||
static struct ctl_table lowpan_frags_ns_ctl_table[] = {
|
static struct ctl_table lowpan_frags_ns_ctl_table[] = {
|
||||||
{
|
{
|
||||||
.procname = "6lowpanfrag_high_thresh",
|
.procname = "6lowpanfrag_high_thresh",
|
||||||
.data = &init_net.ieee802154_lowpan.frags.high_thresh,
|
.data = &init_net.ieee802154_lowpan.frags.high_thresh,
|
||||||
.maxlen = sizeof(int),
|
.maxlen = sizeof(int),
|
||||||
.mode = 0644,
|
.mode = 0644,
|
||||||
.proc_handler = proc_dointvec
|
.proc_handler = proc_dointvec_minmax,
|
||||||
|
.extra1 = &init_net.ieee802154_lowpan.frags.low_thresh
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.procname = "6lowpanfrag_low_thresh",
|
.procname = "6lowpanfrag_low_thresh",
|
||||||
.data = &init_net.ieee802154_lowpan.frags.low_thresh,
|
.data = &init_net.ieee802154_lowpan.frags.low_thresh,
|
||||||
.maxlen = sizeof(int),
|
.maxlen = sizeof(int),
|
||||||
.mode = 0644,
|
.mode = 0644,
|
||||||
.proc_handler = proc_dointvec
|
.proc_handler = proc_dointvec_minmax,
|
||||||
|
.extra1 = &zero,
|
||||||
|
.extra2 = &init_net.ieee802154_lowpan.frags.high_thresh
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.procname = "6lowpanfrag_time",
|
.procname = "6lowpanfrag_time",
|
||||||
@ -446,7 +451,10 @@ static int __net_init lowpan_frags_ns_sysctl_register(struct net *net)
|
|||||||
goto err_alloc;
|
goto err_alloc;
|
||||||
|
|
||||||
table[0].data = &ieee802154_lowpan->frags.high_thresh;
|
table[0].data = &ieee802154_lowpan->frags.high_thresh;
|
||||||
|
table[0].extra1 = &ieee802154_lowpan->frags.low_thresh;
|
||||||
|
table[0].extra2 = &init_net.ieee802154_lowpan.frags.high_thresh;
|
||||||
table[1].data = &ieee802154_lowpan->frags.low_thresh;
|
table[1].data = &ieee802154_lowpan->frags.low_thresh;
|
||||||
|
table[1].extra2 = &ieee802154_lowpan->frags.high_thresh;
|
||||||
table[2].data = &ieee802154_lowpan->frags.timeout;
|
table[2].data = &ieee802154_lowpan->frags.timeout;
|
||||||
table[3].data = &ieee802154_lowpan->max_dsize;
|
table[3].data = &ieee802154_lowpan->max_dsize;
|
||||||
|
|
||||||
|
@ -700,14 +700,17 @@ static struct ctl_table ip4_frags_ns_ctl_table[] = {
|
|||||||
.data = &init_net.ipv4.frags.high_thresh,
|
.data = &init_net.ipv4.frags.high_thresh,
|
||||||
.maxlen = sizeof(int),
|
.maxlen = sizeof(int),
|
||||||
.mode = 0644,
|
.mode = 0644,
|
||||||
.proc_handler = proc_dointvec
|
.proc_handler = proc_dointvec_minmax,
|
||||||
|
.extra1 = &init_net.ipv4.frags.low_thresh
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.procname = "ipfrag_low_thresh",
|
.procname = "ipfrag_low_thresh",
|
||||||
.data = &init_net.ipv4.frags.low_thresh,
|
.data = &init_net.ipv4.frags.low_thresh,
|
||||||
.maxlen = sizeof(int),
|
.maxlen = sizeof(int),
|
||||||
.mode = 0644,
|
.mode = 0644,
|
||||||
.proc_handler = proc_dointvec
|
.proc_handler = proc_dointvec_minmax,
|
||||||
|
.extra1 = &zero,
|
||||||
|
.extra2 = &init_net.ipv4.frags.high_thresh
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.procname = "ipfrag_time",
|
.procname = "ipfrag_time",
|
||||||
@ -752,7 +755,10 @@ static int __net_init ip4_frags_ns_ctl_register(struct net *net)
|
|||||||
goto err_alloc;
|
goto err_alloc;
|
||||||
|
|
||||||
table[0].data = &net->ipv4.frags.high_thresh;
|
table[0].data = &net->ipv4.frags.high_thresh;
|
||||||
|
table[0].extra1 = &net->ipv4.frags.low_thresh;
|
||||||
|
table[0].extra2 = &init_net.ipv4.frags.high_thresh;
|
||||||
table[1].data = &net->ipv4.frags.low_thresh;
|
table[1].data = &net->ipv4.frags.low_thresh;
|
||||||
|
table[1].extra2 = &net->ipv4.frags.high_thresh;
|
||||||
table[2].data = &net->ipv4.frags.timeout;
|
table[2].data = &net->ipv4.frags.timeout;
|
||||||
|
|
||||||
/* Don't export sysctls to unprivileged users */
|
/* Don't export sysctls to unprivileged users */
|
||||||
|
@ -63,6 +63,8 @@ struct nf_ct_frag6_skb_cb
|
|||||||
static struct inet_frags nf_frags;
|
static struct inet_frags nf_frags;
|
||||||
|
|
||||||
#ifdef CONFIG_SYSCTL
|
#ifdef CONFIG_SYSCTL
|
||||||
|
static int zero;
|
||||||
|
|
||||||
static struct ctl_table nf_ct_frag6_sysctl_table[] = {
|
static struct ctl_table nf_ct_frag6_sysctl_table[] = {
|
||||||
{
|
{
|
||||||
.procname = "nf_conntrack_frag6_timeout",
|
.procname = "nf_conntrack_frag6_timeout",
|
||||||
@ -76,14 +78,17 @@ static struct ctl_table nf_ct_frag6_sysctl_table[] = {
|
|||||||
.data = &init_net.nf_frag.frags.low_thresh,
|
.data = &init_net.nf_frag.frags.low_thresh,
|
||||||
.maxlen = sizeof(unsigned int),
|
.maxlen = sizeof(unsigned int),
|
||||||
.mode = 0644,
|
.mode = 0644,
|
||||||
.proc_handler = proc_dointvec,
|
.proc_handler = proc_dointvec_minmax,
|
||||||
|
.extra1 = &zero,
|
||||||
|
.extra2 = &init_net.nf_frag.frags.high_thresh
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.procname = "nf_conntrack_frag6_high_thresh",
|
.procname = "nf_conntrack_frag6_high_thresh",
|
||||||
.data = &init_net.nf_frag.frags.high_thresh,
|
.data = &init_net.nf_frag.frags.high_thresh,
|
||||||
.maxlen = sizeof(unsigned int),
|
.maxlen = sizeof(unsigned int),
|
||||||
.mode = 0644,
|
.mode = 0644,
|
||||||
.proc_handler = proc_dointvec,
|
.proc_handler = proc_dointvec_minmax,
|
||||||
|
.extra1 = &init_net.nf_frag.frags.low_thresh
|
||||||
},
|
},
|
||||||
{ }
|
{ }
|
||||||
};
|
};
|
||||||
@ -102,7 +107,10 @@ static int nf_ct_frag6_sysctl_register(struct net *net)
|
|||||||
|
|
||||||
table[0].data = &net->nf_frag.frags.timeout;
|
table[0].data = &net->nf_frag.frags.timeout;
|
||||||
table[1].data = &net->nf_frag.frags.low_thresh;
|
table[1].data = &net->nf_frag.frags.low_thresh;
|
||||||
|
table[1].extra2 = &net->nf_frag.frags.high_thresh;
|
||||||
table[2].data = &net->nf_frag.frags.high_thresh;
|
table[2].data = &net->nf_frag.frags.high_thresh;
|
||||||
|
table[2].extra1 = &net->nf_frag.frags.low_thresh;
|
||||||
|
table[2].extra2 = &init_net.nf_frag.frags.high_thresh;
|
||||||
}
|
}
|
||||||
|
|
||||||
hdr = register_net_sysctl(net, "net/netfilter", table);
|
hdr = register_net_sysctl(net, "net/netfilter", table);
|
||||||
|
@ -578,20 +578,25 @@ static const struct inet6_protocol frag_protocol =
|
|||||||
};
|
};
|
||||||
|
|
||||||
#ifdef CONFIG_SYSCTL
|
#ifdef CONFIG_SYSCTL
|
||||||
|
static int zero;
|
||||||
|
|
||||||
static struct ctl_table ip6_frags_ns_ctl_table[] = {
|
static struct ctl_table ip6_frags_ns_ctl_table[] = {
|
||||||
{
|
{
|
||||||
.procname = "ip6frag_high_thresh",
|
.procname = "ip6frag_high_thresh",
|
||||||
.data = &init_net.ipv6.frags.high_thresh,
|
.data = &init_net.ipv6.frags.high_thresh,
|
||||||
.maxlen = sizeof(int),
|
.maxlen = sizeof(int),
|
||||||
.mode = 0644,
|
.mode = 0644,
|
||||||
.proc_handler = proc_dointvec
|
.proc_handler = proc_dointvec_minmax,
|
||||||
|
.extra1 = &init_net.ipv6.frags.low_thresh
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.procname = "ip6frag_low_thresh",
|
.procname = "ip6frag_low_thresh",
|
||||||
.data = &init_net.ipv6.frags.low_thresh,
|
.data = &init_net.ipv6.frags.low_thresh,
|
||||||
.maxlen = sizeof(int),
|
.maxlen = sizeof(int),
|
||||||
.mode = 0644,
|
.mode = 0644,
|
||||||
.proc_handler = proc_dointvec
|
.proc_handler = proc_dointvec_minmax,
|
||||||
|
.extra1 = &zero,
|
||||||
|
.extra2 = &init_net.ipv6.frags.high_thresh
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.procname = "ip6frag_time",
|
.procname = "ip6frag_time",
|
||||||
@ -628,7 +633,10 @@ static int __net_init ip6_frags_ns_sysctl_register(struct net *net)
|
|||||||
goto err_alloc;
|
goto err_alloc;
|
||||||
|
|
||||||
table[0].data = &net->ipv6.frags.high_thresh;
|
table[0].data = &net->ipv6.frags.high_thresh;
|
||||||
|
table[0].extra1 = &net->ipv6.frags.low_thresh;
|
||||||
|
table[0].extra2 = &init_net.ipv6.frags.high_thresh;
|
||||||
table[1].data = &net->ipv6.frags.low_thresh;
|
table[1].data = &net->ipv6.frags.low_thresh;
|
||||||
|
table[1].extra2 = &net->ipv6.frags.high_thresh;
|
||||||
table[2].data = &net->ipv6.frags.timeout;
|
table[2].data = &net->ipv6.frags.timeout;
|
||||||
|
|
||||||
/* Don't export sysctls to unprivileged users */
|
/* Don't export sysctls to unprivileged users */
|
||||||
|
Loading…
Reference in New Issue
Block a user