netdev - Re: [net-next,v3] ipv6: shorten reassembly timeout under fragment memory pressure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <207b2879-e022-4b50-837b-d536f8fcabcd@suse.de>
Date: Wed, 11 Feb 2026 16:10:49 +0100
From: Fernando Fernandez Mancera <fmancera@...e.de>
To: soukjin.bae@...sung.com, "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Cc: "netfilter-devel@...r.kernel.org" <netfilter-devel@...r.kernel.org>,
 "davem@...emloft.net" <davem@...emloft.net>,
 "edumazet@...gle.com" <edumazet@...gle.com>,
 "pabeni@...hat.com" <pabeni@...hat.com>,
 "dsahern@...nel.org" <dsahern@...nel.org>, "kuba@...nel.org"
 <kuba@...nel.org>, "horms@...nel.org" <horms@...nel.org>,
 "phil@....cc" <phil@....cc>, "coreteam@...filter.org"
 <coreteam@...filter.org>, "fw@...len.de" <fw@...len.de>,
 "pablo@...filter.org" <pablo@...filter.org>
Subject: Re: [net-next,v3] ipv6: shorten reassembly timeout under fragment
 memory pressure

On 2/11/26 11:32 AM, 배석진 wrote:
>   Changes in v3:
> - Fix build bot error and warnings
> - baseline update
> 
> 
> 
>  From c7940e3dd728fdc58c8199bc031bf3f8f1e8a20f Mon Sep 17 00:00:00 2001
> From: Soukjin Bae <soukjin.bae@...sung.com>
> Date: Wed, 11 Feb 2026 11:20:23 +0900
> Subject: [PATCH] ipv6: shorten reassembly timeout under fragment memory
>   pressure
> 
> Under heavy IPv6 fragmentation, incomplete fragment queues may persist
> for the full reassembly timeout even when fragment memory is under
> pressure.
> 
> This can lead to prolonged retention of fragment queues that are unlikely
> to complete, causing newly arriving fragmented packets to be dropped due
> to memory exhaustion.
> 
> Introduce an optional mechanism to shorten the IPv6 reassembly timeout
> when fragment memory usage exceeds the low threshold. Different timeout
> values are applied depending on the upper-layer protocol to balance
> eviction speed and completion probability.
> 
> Signed-off-by: Soukjin Bae <soukjin.bae@...sung.com>

Hello,

isn't this what net.ipv6.ip6frag_time does? In addition, the situation 
you described could be overcome by increasing the memory thresholds at 
net.ipv6.ip6frag_low_thresh and net.ipv6.ip6frag_high_thresh.

Please, let me know if I am missing something.

Thanks,
Fernando.