All of lore.kernel.org
 help / color / mirror / Atom feed
From: Cong Wang <xiyou.wangcong@gmail.com>
To: Florian Westphal <fw@strlen.de>
Cc: Linux Kernel Network Developers <netdev@vger.kernel.org>,
	NetFilter <netfilter-devel@vger.kernel.org>,
	syzbot <syzbot+adf6c6c2be1c3a718121@syzkaller.appspotmail.com>,
	Pablo Neira Ayuso <pablo@netfilter.org>,
	Jozsef Kadlecsik <kadlec@netfilter.org>
Subject: Re: [Patch nf 3/3] xt_hashlimit: limit the max size of hashtable
Date: Fri, 31 Jan 2020 18:53:21 -0800	[thread overview]
Message-ID: <CAM_iQpWbejoFPbFDSfUtvhFbU3DjhV6NAkPQ+-mirY_QEMHxkA@mail.gmail.com> (raw)
In-Reply-To: <20200131233659.GM795@breakpoint.cc>

On Fri, Jan 31, 2020 at 3:37 PM Florian Westphal <fw@strlen.de> wrote:
> O would propose a max alloc size (hard limit) of ~8 MByte of vmalloc
> space, or maybe 16 at most.
>
> 1048576 max upperlimit -> ~8mbyte vmalloc request -> allows to store
> up to 2**23 entries.

Changing HASHLIMIT_MAX_SIZE to 1048576 seems fine.

>
> In order to prevent breaking userspace, perhaps make it so that the
> kernel caps cfg.max at twice that value?  Would allow storing up to
> 16777216 addresses with an average chain depth of 16 (which is quite
> large).  We could increase the max limit in case someone presents a use
> case.
>

Not sure if I understand this, I don't see how cap'ing cfg->max could
help prevent breaking user-space? Are you suggesting to cap it with
HASHLIMIT_MAX_SIZE too? Something like below?

+       if (cfg->max > 2 * HASHLIMIT_MAX_SIZE)
+               cfg->max = 2 * HASHLIMIT_MAX_SIZE;

Thanks.

  reply	other threads:[~2020-02-01  2:53 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-01-31 20:52 [Patch nf 0/3] netfilter: xt_hashlimit: a few improvements Cong Wang
2020-01-31 20:52 ` [Patch nf 1/3] xt_hashlimit: avoid OOM for user-controlled vmalloc Cong Wang
2020-01-31 22:08   ` Florian Westphal
2020-01-31 23:17     ` Cong Wang
2020-01-31 20:52 ` [Patch nf 2/3] xt_hashlimit: reduce hashlimit_mutex scope for htable_put() Cong Wang
2020-01-31 22:09   ` Florian Westphal
2020-01-31 20:52 ` [Patch nf 3/3] xt_hashlimit: limit the max size of hashtable Cong Wang
2020-01-31 22:08   ` Florian Westphal
2020-01-31 23:16     ` Cong Wang
2020-01-31 23:36       ` Florian Westphal
2020-02-01  2:53         ` Cong Wang [this message]
2020-02-02  6:16           ` Florian Westphal
2020-02-02 18:27             ` Cong Wang
2020-02-02 22:37               ` Florian Westphal

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAM_iQpWbejoFPbFDSfUtvhFbU3DjhV6NAkPQ+-mirY_QEMHxkA@mail.gmail.com \
    --to=xiyou.wangcong@gmail.com \
    --cc=fw@strlen.de \
    --cc=kadlec@netfilter.org \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=pablo@netfilter.org \
    --cc=syzbot+adf6c6c2be1c3a718121@syzkaller.appspotmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.