netdev - Re: [PATCH] neighbour: guarantee the localhost connections be established successfully even the ARP table is full

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20240415181550.GF2320920@kernel.org>
Date: Mon, 15 Apr 2024 19:15:50 +0100
From: Simon Horman <horms@...nel.org>
To: Zheng Li <lizheng043@...il.com>
Cc: netdev@...r.kernel.org, bpf@...r.kernel.org, kuba@...nel.org,
	davem@...emloft.net, jmorris@...ei.org, James.Z.Li@...l.com
Subject: Re: [PATCH] neighbour: guarantee the localhost connections be
 established successfully even the ARP table is full

On Fri, Apr 12, 2024 at 08:25:38PM +0800, Zheng Li wrote:
> From: Zheng Li <James.Z.Li@...l.com>
> 
> Inter-process communication on localhost should be established successfully even the ARP table is full,
> many processes on server machine use the localhost to communicate such as command-line interface (CLI),
> servers hope all CLI commands can be executed successfully even the arp table is full.
> Right now CLI commands got timeout when the arp table is full.
> Set the parameter of exempt_from_gc to be true for LOOPBACK net device to
> keep localhost neigh in arp table, not removed by gc.
> 
> the steps of reproduced:
> server with "gc_thresh3 = 1024" setting, ping server from more than 1024 IPv4 addresses,
> run "ssh localhost" on console interface, then the command will get timeout.
> 
> Signed-off-by: Zheng Li <James.Z.Li@...l.com>
> ---
>  net/core/neighbour.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/net/core/neighbour.c b/net/core/neighbour.c
> index 552719c3bbc3..d96dee3d4af6 100644
> --- a/net/core/neighbour.c
> +++ b/net/core/neighbour.c
> @@ -734,7 +734,10 @@ ___neigh_create(struct neigh_table *tbl, const void *pkey,
>  struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
>  				 struct net_device *dev, bool want_ref)
>  {
> -	return ___neigh_create(tbl, pkey, dev, 0, false, want_ref);
> +	if (dev->flags & IFF_LOOPBACK)
> +		return ___neigh_create(tbl, pkey, dev, 0, true, want_ref);
> +	else
> +		return ___neigh_create(tbl, pkey, dev, 0, false, want_ref);
>  }
>  EXPORT_SYMBOL(__neigh_create);

Hi James,

I'm not commenting on the merits of your patch - I'm sure
the maintainers will do so when you repost as Jakub has suggested.

But wile looking at this it seemed to me that the following might
be a cleaner way to express your change.

struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
				 struct net_device *dev, bool want_ref)
{
	bool exempt_from_gc = !!(dev->flags & IFF_LOOPBACK);

	return ___neigh_create(tbl, pkey, dev, 0, exempt_from_gc,  want_ref);
}