From: Cyrill Gorcunov <gorcu...@gmail.com> Date: Sat, 5 Mar 2016 00:39:20 +0300
> Currenlty all the kernels (including vanilla) free ifa > list under rtln_lock() taken which takes a huge time > to release all entries when we stop the container. > Moreover it's allowed to create unlimited number > of addresses from inside of net-namespace if > CAP-NET_ADMIN granted (which is common for containers). > > Lets introduce per-net limit (4096 by default) > of addresses, which can be tuned up via sysfs > entry /proc/sys/net/ipv4/ifa_limit. > > Reported-by: Solar Designer <so...@openwall.com> > Signed-off-by: Cyrill Gorcunov <gorcu...@virtuozzo.com> Arbitrary limits are... arbitrary. If the freeing loop is the issue, splice the list at teardown and process that list asynchronously via a workqueue or similar. Thanks.
