Commit 1bab4c75 authored by Nikolay Aleksandrov's avatar Nikolay Aleksandrov Committed by David S. Miller
Browse files

inet: frag: set limits and make init_net's high_thresh limit global 



This patch makes init_net's high_thresh limit to be the maximum for all
namespaces, thus introducing a global memory limit threshold equal to the
sum of the individual high_thresh limits which are capped.
It also introduces some sane minimums for low_thresh as it shouldn't be
able to drop below 0 (or > high_thresh in the unsigned case), and
overall low_thresh should not ever be above high_thresh, so we make the
following relations for a namespace:
init_net:
 high_thresh - max(not capped), min(init_net low_thresh)
 low_thresh - max(init_net high_thresh), min (0)

all other namespaces:
 high_thresh = max(init_net high_thresh), min(namespace's low_thresh)
 low_thresh = max(namespace's high_thresh), min(0)

The major issue with having low_thresh > high_thresh is that we'll
schedule eviction but never evict anything and thus rely only on the
timers.

Signed-off-by: default avatarNikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent ab1c724f

Documentation/networking/ip-sysctl.txt

+2 −1
Original line number Diff line number Diff line
@@ -101,7 +101,8 @@ ipfrag_high_thresh - INTEGER 
	Maximum memory used to reassemble IP fragments. When

	ipfrag_high_thresh bytes of memory is allocated for this purpose,

	the fragment handler will toss packets until ipfrag_low_thresh

	is reached.

	is reached. This also serves as a maximum limit to namespaces

	different from the initial one.



ipfrag_low_thresh - INTEGER

	Maximum memory used to reassemble IP fragments before the kernel

net/ieee802154/reassembly.c

+10 −2
Original line number Diff line number Diff line
@@ -386,20 +386,25 @@ err: 
EXPORT_SYMBOL(lowpan_frag_rcv);



#ifdef CONFIG_SYSCTL

static int zero;



static struct ctl_table lowpan_frags_ns_ctl_table[] = {

	{

		.procname	= "6lowpanfrag_high_thresh",

		.data		= &init_net.ieee802154_lowpan.frags.high_thresh,

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_dointvec

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= &init_net.ieee802154_lowpan.frags.low_thresh

	},

	{

		.procname	= "6lowpanfrag_low_thresh",

		.data		= &init_net.ieee802154_lowpan.frags.low_thresh,

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_dointvec

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= &zero,

		.extra2		= &init_net.ieee802154_lowpan.frags.high_thresh

	},

	{

		.procname	= "6lowpanfrag_time",
@@ -446,7 +451,10 @@ static int __net_init lowpan_frags_ns_sysctl_register(struct net *net) 
			goto err_alloc;



		table[0].data = &ieee802154_lowpan->frags.high_thresh;

		table[0].extra1 = &ieee802154_lowpan->frags.low_thresh;

		table[0].extra2 = &init_net.ieee802154_lowpan.frags.high_thresh;

		table[1].data = &ieee802154_lowpan->frags.low_thresh;

		table[1].extra2 = &ieee802154_lowpan->frags.high_thresh;

		table[2].data = &ieee802154_lowpan->frags.timeout;

		table[3].data = &ieee802154_lowpan->max_dsize;

net/ipv4/ip_fragment.c

+8 −2
Original line number Diff line number Diff line
@@ -700,14 +700,17 @@ static struct ctl_table ip4_frags_ns_ctl_table[] = { 
		.data		= &init_net.ipv4.frags.high_thresh,

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_dointvec

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= &init_net.ipv4.frags.low_thresh

	},

	{

		.procname	= "ipfrag_low_thresh",

		.data		= &init_net.ipv4.frags.low_thresh,

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_dointvec

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= &zero,

		.extra2		= &init_net.ipv4.frags.high_thresh

	},

	{

		.procname	= "ipfrag_time",
@@ -752,7 +755,10 @@ static int __net_init ip4_frags_ns_ctl_register(struct net *net) 
			goto err_alloc;



		table[0].data = &net->ipv4.frags.high_thresh;

		table[0].extra1 = &net->ipv4.frags.low_thresh;

		table[0].extra2 = &init_net.ipv4.frags.high_thresh;

		table[1].data = &net->ipv4.frags.low_thresh;

		table[1].extra2 = &net->ipv4.frags.high_thresh;

		table[2].data = &net->ipv4.frags.timeout;



		/* Don't export sysctls to unprivileged users */

net/ipv6/netfilter/nf_conntrack_reasm.c

+10 −2
Original line number Diff line number Diff line
@@ -63,6 +63,8 @@ struct nf_ct_frag6_skb_cb 
static struct inet_frags nf_frags;



#ifdef CONFIG_SYSCTL

static int zero;



static struct ctl_table nf_ct_frag6_sysctl_table[] = {

	{

		.procname	= "nf_conntrack_frag6_timeout",
@@ -76,14 +78,17 @@ static struct ctl_table nf_ct_frag6_sysctl_table[] = { 
		.data		= &init_net.nf_frag.frags.low_thresh,

		.maxlen		= sizeof(unsigned int),

		.mode		= 0644,

		.proc_handler	= proc_dointvec,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= &zero,

		.extra2		= &init_net.nf_frag.frags.high_thresh

	},

	{

		.procname	= "nf_conntrack_frag6_high_thresh",

		.data		= &init_net.nf_frag.frags.high_thresh,

		.maxlen		= sizeof(unsigned int),

		.mode		= 0644,

		.proc_handler	= proc_dointvec,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= &init_net.nf_frag.frags.low_thresh

	},

	{ }

};
@@ -102,7 +107,10 @@ static int nf_ct_frag6_sysctl_register(struct net *net) 


		table[0].data = &net->nf_frag.frags.timeout;

		table[1].data = &net->nf_frag.frags.low_thresh;

		table[1].extra2 = &net->nf_frag.frags.high_thresh;

		table[2].data = &net->nf_frag.frags.high_thresh;

		table[2].extra1 = &net->nf_frag.frags.low_thresh;

		table[2].extra2 = &init_net.nf_frag.frags.high_thresh;

	}



	hdr = register_net_sysctl(net, "net/netfilter", table);

net/ipv6/reassembly.c

+10 −2
Original line number Diff line number Diff line
@@ -578,20 +578,25 @@ static const struct inet6_protocol frag_protocol = 
};



#ifdef CONFIG_SYSCTL

static int zero;



static struct ctl_table ip6_frags_ns_ctl_table[] = {

	{

		.procname	= "ip6frag_high_thresh",

		.data		= &init_net.ipv6.frags.high_thresh,

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_dointvec

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= &init_net.ipv6.frags.low_thresh

	},

	{

		.procname	= "ip6frag_low_thresh",

		.data		= &init_net.ipv6.frags.low_thresh,

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_dointvec

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= &zero,

		.extra2		= &init_net.ipv6.frags.high_thresh

	},

	{

		.procname	= "ip6frag_time",
@@ -628,7 +633,10 @@ static int __net_init ip6_frags_ns_sysctl_register(struct net *net) 
			goto err_alloc;



		table[0].data = &net->ipv6.frags.high_thresh;

		table[0].extra1 = &net->ipv6.frags.low_thresh;

		table[0].extra2 = &init_net.ipv6.frags.high_thresh;

		table[1].data = &net->ipv6.frags.low_thresh;

		table[1].extra2 = &net->ipv6.frags.high_thresh;

		table[2].data = &net->ipv6.frags.timeout;



		/* Don't export sysctls to unprivileged users */

CRA Git | Maintained and supported by SUSTech CRA and CCSE