Commit 3c2a89dd authored by Florian Westphal's avatar Florian Westphal Committed by David S. Miller
Browse files

net: xfrm: revert to lower xfrm dst gc limit 



revert c386578f ("xfrm: Let the flowcache handle its size by default.").

Once we remove flow cache, we don't have a flow cache limit anymore.
We must not allow (virtually) unlimited allocations of xfrm dst entries.
Revert back to the old xfrm dst gc limits.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6b1c42e9

Documentation/networking/ip-sysctl.txt

+2 −4
Original line number Original line Diff line number Diff line
@@ -1291,8 +1291,7 @@ tag - INTEGER 
xfrm4_gc_thresh - INTEGER

xfrm4_gc_thresh - INTEGER

	The threshold at which we will start garbage collecting for IPv4

	The threshold at which we will start garbage collecting for IPv4

	destination cache entries.  At twice this value the system will

	destination cache entries.  At twice this value the system will

	refuse new allocations. The value must be set below the flowcache

	refuse new allocations.

	limit (4096 * number of online cpus) to take effect.





igmp_link_local_mcast_reports - BOOLEAN

igmp_link_local_mcast_reports - BOOLEAN

	Enable IGMP reports for link local multicast groups in the

	Enable IGMP reports for link local multicast groups in the
@@ -1778,8 +1777,7 @@ ratelimit - INTEGER 
xfrm6_gc_thresh - INTEGER

xfrm6_gc_thresh - INTEGER

	The threshold at which we will start garbage collecting for IPv6

	The threshold at which we will start garbage collecting for IPv6

	destination cache entries.  At twice this value the system will

	destination cache entries.  At twice this value the system will

	refuse new allocations. The value must be set below the flowcache

	refuse new allocations.

	limit (4096 * number of online cpus) to take effect.









IPv6 Update by:

IPv6 Update by:

net/ipv4/xfrm4_policy.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -266,7 +266,7 @@ static struct dst_ops xfrm4_dst_ops_template = { 
	.destroy =		xfrm4_dst_destroy,

	.destroy =		xfrm4_dst_destroy,

	.ifdown =		xfrm4_dst_ifdown,

	.ifdown =		xfrm4_dst_ifdown,

	.local_out =		__ip_local_out,

	.local_out =		__ip_local_out,

	.gc_thresh =		INT_MAX,

	.gc_thresh =		32768,

};

};





static const struct xfrm_policy_afinfo xfrm4_policy_afinfo = {

static const struct xfrm_policy_afinfo xfrm4_policy_afinfo = {

net/ipv6/xfrm6_policy.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -286,7 +286,7 @@ static struct dst_ops xfrm6_dst_ops_template = { 
	.destroy =		xfrm6_dst_destroy,

	.destroy =		xfrm6_dst_destroy,

	.ifdown =		xfrm6_dst_ifdown,

	.ifdown =		xfrm6_dst_ifdown,

	.local_out =		__ip6_local_out,

	.local_out =		__ip6_local_out,

	.gc_thresh =		INT_MAX,

	.gc_thresh =		32768,

};

};





static const struct xfrm_policy_afinfo xfrm6_policy_afinfo = {

static const struct xfrm_policy_afinfo xfrm6_policy_afinfo = {

CRA Git | Maintained and supported by SUSTech CRA and CCSE