[PATCH] netfilter: conntrack: document sparse hash table eviction

[Vikash SS <thisisforspotifyvikash@gmail.com>]

When nf_conntrack_max is significantly smaller than
nf_conntrack_buckets, the hash table can become sparsely populated.

The early_drop() path examines at most 8 consecutive hash buckets
when searching for eviction candidates. Under table exhaustion,
this bounded search may fail to find an eligible entry even when
evictable connections exist elsewhere in the table.

Document this limitation to clarify the implications of configuring
nf_conntrack_max significantly below nf_conntrack_buckets.

Signed-off-by: Vikash SS <thisisforspotifyvikash@gmail.com>
---
 Documentation/networking/nf_conntrack-sysctl.rst | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Documentation/networking/nf_conntrack-sysctl.rst b/Documentation/networking/nf_conntrack-sysctl.rst
index 4426cce2a..fc07a950b 100644
--- a/Documentation/networking/nf_conntrack-sysctl.rst
+++ b/Documentation/networking/nf_conntrack-sysctl.rst
@@ -99,6 +99,10 @@ nf_conntrack_max - INTEGER
         the reversed address). This means that with default settings a maxed-out
         table will have a average hash chain length of 2, not 1.
 
+        Setting nf_conntrack_max much lower than nf_conntrack_buckets
+        may cause early eviction to fail under table exhaustion, as
+        the eviction search may not find entries in sparse hash tables.
+
 nf_conntrack_tcp_be_liberal - BOOLEAN
 	- 0 - disabled (default)
 	- not 0 - enabled
-- 
2.34.1