On ven., 2016-03-04 at 17:50 -0500, David Miller wrote: > From: Cyrill Gorcunov <gorcu...@gmail.com> > Date: Sat, 5 Mar 2016 00:39:20 +0300 > > > Currenlty all the kernels (including vanilla) free ifa > > list under rtln_lock() taken which takes a huge time > > to release all entries when we stop the container. > > Moreover it's allowed to create unlimited number > > of addresses from inside of net-namespace if > > CAP-NET_ADMIN granted (which is common for containers). > > > > Lets introduce per-net limit (4096 by default) > > of addresses, which can be tuned up via sysfs > > entry /proc/sys/net/ipv4/ifa_limit. > > > > Reported-by: Solar Designer <so...@openwall.com> > > Signed-off-by: Cyrill Gorcunov <gorcu...@virtuozzo.com> > > Arbitrary limits are... arbitrary. > > If the freeing loop is the issue, splice the list at teardown and > process that list asynchronously via a workqueue or similar. > > Thanks.
Also I wonder if the problem is not a quadratic behavior. __inet_del_ifa() should probably take into account in_dev->dead (no promotion, no list scan...)
