Re: [PATCH nf v2 0/1] ipvs: bound LBLCR and LBLC cache growth

[Julian Anastasov <ja@ssi.bg>]

	Hello,

On Mon, 17 Aug 2026, Zhiling Zou wrote:

> Hi Linux kernel maintainers,
> 
> We found and validated an issue in net/netfilter/ipvs/ip_vs_lblcr.c.
> The bug is reachable by a non-root user through a new user and network
> namespace. The same cache growth bound is also missing from the sibling
> LBLC scheduler in net/netfilter/ipvs/ip_vs_lblc.c.

	Sashiko reports for a missing atomic_dec(&tbl->entries)
in ip_vs_lblc_new(), after the ip_vs_lblc_del(en) call:

https://sashiko.dev/#/patchset/17cbb1d0649f4e19aa2e407ab4b528d42b8edac4.1786949472.git.zhilinz%40nebusec.ai

	But it is not related to this patch. The GC
probably needs to be improved because with this patch
we should be freeing 16 entries in average from single
bucket but before that we are not caching new dests for
60 secs.

	While max_size works like a low threshold for
entries in cache, we do not define maximum to apply.
After checking the code again, we may need to provide more
bonus for the normal traffic to cache entries in the next
minute (eg. +50%) while we are freeing cached entries in
the background to free space for the new dests. Because
without caching we are not using the servers persistently.

	May be separate patch can rename max_size to
min_size and to add max_size = min_size * 3 / 2 as a
limit for allocations. For this patch we can use just
"max_size * 3 / 2".

Regards

--
Julian Anastasov <ja@ssi.bg>