Re: [Patch net-next] net: make neigh tables per netns

[David Miller <davem@davemloft.net>]

From: ebiederm@xmission.com (Eric W. Biederman)
Date: Thu, 26 Jun 2014 14:53:42 -0700

> The highlights of our earlier conversation.

Thanks for the context.

First of all it is clear that once you start creating containers on the
order of half the global neigh limit, yes you will run into problems as
it's easy to have 2 or more outputs in flight.

So it would perhaps be wise to scale the limits (in some way) based
upon the number of namespaces, but still keep it a global limit.

These entries consume a global resource (memory) and benefit from
global sharing, so I am still convinced that making the tables
themselves per-ns does not make any sense.

Secondly, if there are things holding onto neighbour entries for real
we should find this out.  Once could audit neigh_lookup*() invocations
to see where that might be happening.  Also neigh_create() calls with
'want_ref' set to true.

Finally, another problem are permanent neigh entries as those cannot
be reclaimed, that might be part of the main problem here.

One idea wrt. permanent entries is that we could decide that, since
they are administratively added, they don't count against the
thresholds and limits.