* [PATCH 1/4] UDP memory accounting and limitation(take 5): fix send buffer check
2007-10-12 12:00 [PATCH 0/4]UDP memory accounting and limitation(take 5) Satoshi OSHIMA
@ 2007-10-12 12:01 ` Satoshi OSHIMA
2007-10-12 12:07 ` [PATCH 2/4] UDP memory accounting and limitation(take 5): accounting unit and variable Satoshi OSHIMA
` (2 subsequent siblings)
3 siblings, 0 replies; 8+ messages in thread
From: Satoshi OSHIMA @ 2007-10-12 12:01 UTC (permalink / raw)
To: David Miller, netdev
Cc: Hideo AOKI, Yumiko SUGITA, "??@RedHat", Andi Kleen,
Evgeniy Polyakov, Herbert Xu, Stephen Hemminger, ?? ??
This patch introduces sndbuf size check before
memory allcation for send buffer.
signed-off-by: Satoshi Oshima <satoshi.oshima.fk@hitachi.com>
signed-off-by: Hideo Aoki <haoki@redhat.com>
Index: 2.6.23-rc7-udp_limit/net/ipv4/ip_output.c
===================================================================
--- 2.6.23-rc7-udp_limit.orig/net/ipv4/ip_output.c
+++ 2.6.23-rc7-udp_limit/net/ipv4/ip_output.c
@@ -1004,6 +1004,11 @@ alloc_new_skb:
frag = &skb_shinfo(skb)->frags[i];
}
} else if (i < MAX_SKB_FRAGS) {
+ if (atomic_read(&sk->sk_wmem_alloc) + PAGE_SIZE
+ > 2 * sk->sk_sndbuf) {
+ err = -ENOBUFS;
+ goto error;
+ }
if (copy > PAGE_SIZE)
copy = PAGE_SIZE;
page = alloc_pages(sk->sk_allocation, 0);
^ permalink raw reply [flat|nested] 8+ messages in thread* [PATCH 2/4] UDP memory accounting and limitation(take 5): accounting unit and variable
2007-10-12 12:00 [PATCH 0/4]UDP memory accounting and limitation(take 5) Satoshi OSHIMA
2007-10-12 12:01 ` [PATCH 1/4] UDP memory accounting and limitation(take 5): fix send buffer check Satoshi OSHIMA
@ 2007-10-12 12:07 ` Satoshi OSHIMA
2007-10-12 12:10 ` [PATCH 3/4] UDP memory accounting and limitation(take 5): memory accounting Satoshi OSHIMA
2007-10-12 12:11 ` [PATCH 4/4] UDP memory accounting and limitation(take 5): memory limitation Satoshi OSHIMA
3 siblings, 0 replies; 8+ messages in thread
From: Satoshi OSHIMA @ 2007-10-12 12:07 UTC (permalink / raw)
To: David Miller, netdev
Cc: Hideo AOKI, Yumiko SUGITA, "青木@RedHat",
Andi Kleen, Evgeniy Polyakov, Herbert Xu, Stephen Hemminger,
吉藤 英明
This patch introduces global variable for UDP memory accounting.
The unit is page.
signed-off-by: Satoshi Oshima <satoshi.oshima.fk@hitachi.com>
signed-off-by: Hideo Aoki <haoki@redhat.com>
Index: 2.6.23-udp_limit/include/net/sock.h
===================================================================
--- 2.6.23-udp_limit.orig/include/net/sock.h
+++ 2.6.23-udp_limit/include/net/sock.h
@@ -723,6 +723,13 @@ static inline int sk_stream_wmem_schedul
sk_stream_mem_schedule(sk, size, 0);
}
+#define SK_DATAGRAM_MEM_QUANTUM ((int)PAGE_SIZE)
+
+static inline int sk_datagram_pages(int amt)
+{
+ return DIV_ROUND_UP(amt, SK_DATAGRAM_MEM_QUANTUM);
+}
+
/* Used by processes to "lock" a socket state, so that
* interrupts and bottom half handlers won't change it
* from under us. It essentially blocks any incoming
Index: 2.6.23-udp_limit/include/net/udp.h
===================================================================
--- 2.6.23-udp_limit.orig/include/net/udp.h
+++ 2.6.23-udp_limit/include/net/udp.h
@@ -65,6 +65,8 @@ extern rwlock_t udp_hash_lock;
extern struct proto udp_prot;
+extern atomic_t udp_memory_allocated;
+
struct sk_buff;
/*
Index: 2.6.23-udp_limit/net/ipv4/proc.c
===================================================================
--- 2.6.23-udp_limit.orig/net/ipv4/proc.c
+++ 2.6.23-udp_limit/net/ipv4/proc.c
@@ -66,7 +66,8 @@ static int sockstat_seq_show(struct seq_
fold_prot_inuse(&tcp_prot), atomic_read(&tcp_orphan_count),
tcp_death_row.tw_count, atomic_read(&tcp_sockets_allocated),
atomic_read(&tcp_memory_allocated));
- seq_printf(seq, "UDP: inuse %d\n", fold_prot_inuse(&udp_prot));
+ seq_printf(seq, "UDP: inuse %d mem %d\n", fold_prot_inuse(&udp_prot),
+ atomic_read(&udp_memory_allocated));
seq_printf(seq, "UDPLITE: inuse %d\n", fold_prot_inuse(&udplite_prot));
seq_printf(seq, "RAW: inuse %d\n", fold_prot_inuse(&raw_prot));
seq_printf(seq, "FRAG: inuse %d memory %d\n", ip_frag_nqueues,
Index: 2.6.23-udp_limit/net/ipv4/udp.c
===================================================================
--- 2.6.23-udp_limit.orig/net/ipv4/udp.c
+++ 2.6.23-udp_limit/net/ipv4/udp.c
@@ -113,6 +113,8 @@ DEFINE_SNMP_STAT(struct udp_mib, udp_sta
struct hlist_head udp_hash[UDP_HTABLE_SIZE];
DEFINE_RWLOCK(udp_hash_lock);
+atomic_t udp_memory_allocated;
+
static int udp_port_rover;
static inline int __udp_lib_lport_inuse(__u16 num, struct hlist_head udptable[])
^ permalink raw reply [flat|nested] 8+ messages in thread* [PATCH 3/4] UDP memory accounting and limitation(take 5): memory accounting
2007-10-12 12:00 [PATCH 0/4]UDP memory accounting and limitation(take 5) Satoshi OSHIMA
2007-10-12 12:01 ` [PATCH 1/4] UDP memory accounting and limitation(take 5): fix send buffer check Satoshi OSHIMA
2007-10-12 12:07 ` [PATCH 2/4] UDP memory accounting and limitation(take 5): accounting unit and variable Satoshi OSHIMA
@ 2007-10-12 12:10 ` Satoshi OSHIMA
2007-10-12 12:11 ` [PATCH 4/4] UDP memory accounting and limitation(take 5): memory limitation Satoshi OSHIMA
3 siblings, 0 replies; 8+ messages in thread
From: Satoshi OSHIMA @ 2007-10-12 12:10 UTC (permalink / raw)
To: David Miller, netdev
Cc: Hideo AOKI, Yumiko SUGITA, "青木@RedHat",
Andi Kleen, Evgeniy Polyakov, Herbert Xu, Stephen Hemminger,
吉藤 英明
This patch introduces memory usage accounting for UDP.
signed-off-by: Satoshi Oshima <satoshi.oshima.fk@hitachi.com>
signed-off-by: Hideo Aoki <haoki@redhat.com>
Index: 2.6.23-udp_limit/net/ipv4/ip_output.c
===================================================================
--- 2.6.23-udp_limit.orig/net/ipv4/ip_output.c
+++ 2.6.23-udp_limit/net/ipv4/ip_output.c
@@ -743,6 +743,8 @@ static inline int ip_ufo_append_data(str
/* specify the length of each IP datagram fragment*/
skb_shinfo(skb)->gso_size = mtu - fragheaderlen;
skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
+ atomic_add(sk_datagram_pages(skb->truesize),
+ sk->sk_prot->memory_allocated);
__skb_queue_tail(&sk->sk_write_queue, skb);
return 0;
@@ -924,6 +926,9 @@ alloc_new_skb:
}
if (skb == NULL)
goto error;
+ if (sk->sk_prot->memory_allocated)
+ atomic_add(sk_datagram_pages(skb->truesize),
+ sk->sk_prot->memory_allocated);
/*
* Fill in the control structures
@@ -1023,6 +1028,8 @@ alloc_new_skb:
frag = &skb_shinfo(skb)->frags[i];
skb->truesize += PAGE_SIZE;
atomic_add(PAGE_SIZE, &sk->sk_wmem_alloc);
+ if (sk->sk_prot->memory_allocated)
+ atomic_inc(sk->sk_prot->memory_allocated);
} else {
err = -EMSGSIZE;
goto error;
@@ -1123,7 +1130,9 @@ ssize_t ip_append_page(struct sock *sk,
if (unlikely(!skb)) {
err = -ENOBUFS;
goto error;
- }
+ } else if (sk->sk_prot->memory_allocated)
+ atomic_add(sk_datagram_pages(skb->truesize),
+ sk->sk_prot->memory_allocated);
/*
* Fill in the control structures
@@ -1202,13 +1211,14 @@ int ip_push_pending_frames(struct sock *
struct iphdr *iph;
__be16 df = 0;
__u8 ttl;
- int err = 0;
+ int err = 0, send_page_size;
if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL)
goto out;
tail_skb = &(skb_shinfo(skb)->frag_list);
/* move skb->data to ip header from ext header */
+ send_page_size = sk_datagram_pages(skb->truesize);
if (skb->data < skb_network_header(skb))
__skb_pull(skb, skb_network_offset(skb));
while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) {
@@ -1218,6 +1228,7 @@ int ip_push_pending_frames(struct sock *
skb->len += tmp_skb->len;
skb->data_len += tmp_skb->len;
skb->truesize += tmp_skb->truesize;
+ send_page_size += sk_datagram_pages(tmp_skb->truesize);
__sock_put(tmp_skb->sk);
tmp_skb->destructor = NULL;
tmp_skb->sk = NULL;
@@ -1269,6 +1280,8 @@ int ip_push_pending_frames(struct sock *
/* Netfilter gets whole the not fragmented skb. */
err = NF_HOOK(PF_INET, NF_IP_LOCAL_OUT, skb, NULL,
skb->dst->dev, dst_output);
+ if (sk->sk_prot->memory_allocated)
+ atomic_sub(send_page_size, sk->sk_prot->memory_allocated);
if (err) {
if (err > 0)
err = inet->recverr ? net_xmit_errno(err) : 0;
@@ -1298,9 +1311,15 @@ void ip_flush_pending_frames(struct sock
{
struct inet_sock *inet = inet_sk(sk);
struct sk_buff *skb;
+ int num_flush_mem = 0;
- while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL)
+ while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
+ num_flush_mem += sk_datagram_pages(skb->truesize);
kfree_skb(skb);
+ }
+
+ if (sk->sk_prot->memory_allocated)
+ atomic_sub(num_flush_mem, sk->sk_prot->memory_allocated);
inet->cork.flags &= ~IPCORK_OPT;
kfree(inet->cork.opt);
Index: 2.6.23-udp_limit/net/ipv4/udp.c
===================================================================
--- 2.6.23-udp_limit.orig/net/ipv4/udp.c
+++ 2.6.23-udp_limit/net/ipv4/udp.c
@@ -885,6 +885,9 @@ try_again:
err = ulen;
out_free:
+ atomic_sub(sk_datagram_pages(skb->truesize),
+ sk->sk_prot->memory_allocated);
+
skb_free_datagram(sk, skb);
out:
return err;
@@ -892,6 +895,9 @@ out:
csum_copy_err:
UDP_INC_STATS_BH(UDP_MIB_INERRORS, is_udplite);
+ atomic_sub(sk_datagram_pages(skb->truesize),
+ sk->sk_prot->memory_allocated);
+
skb_kill_datagram(sk, skb, flags);
if (noblock)
@@ -1017,6 +1023,9 @@ int udp_queue_rcv_skb(struct sock * sk,
goto drop;
}
+ atomic_add(sk_datagram_pages(skb->truesize),
+ sk->sk_prot->memory_allocated);
+
UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS, up->pcflag);
return 0;
@@ -1441,6 +1450,7 @@ struct proto udp_prot = {
.hash = udp_lib_hash,
.unhash = udp_lib_unhash,
.get_port = udp_v4_get_port,
+ .memory_allocated = &udp_memory_allocated,
.obj_size = sizeof(struct udp_sock),
#ifdef CONFIG_COMPAT
.compat_setsockopt = compat_udp_setsockopt,
Index: 2.6.23-udp_limit/net/ipv4/af_inet.c
===================================================================
--- 2.6.23-udp_limit.orig/net/ipv4/af_inet.c
+++ 2.6.23-udp_limit/net/ipv4/af_inet.c
@@ -126,13 +126,41 @@ extern void ip_mc_drop_socket(struct soc
static struct list_head inetsw[SOCK_MAX];
static DEFINE_SPINLOCK(inetsw_lock);
+/**
+ * __skb_queue_purge_and_sub_memory_allocated
+ * - empty a list and subtruct memory allocation counter
+ * @sk: sk
+ * @list: list to empty
+ * Delete all buffers on an &sk_buff list and subtruct the
+ * turesize of the sk_buff for memory accounting. Each buffer
+ * is removed from the list and one reference dropped. This
+ * function does not take the list lock and the caller must
+ * hold the relevant locks to use it.
+ */
+void __skb_queue_purge_and_sub_memory_allocated(struct sock *sk,
+ struct sk_buff_head *list)
+{
+ struct sk_buff *skb;
+ int purged_skb_size = 0;
+ while ((skb = __skb_dequeue(list)) != NULL) {
+ purged_skb_size += sk_datagram_pages(skb->truesize);
+ kfree_skb(skb);
+ }
+ atomic_sub(purged_skb_size, sk->sk_prot->memory_allocated);
+}
+
/* New destruction routine */
void inet_sock_destruct(struct sock *sk)
{
struct inet_sock *inet = inet_sk(sk);
- __skb_queue_purge(&sk->sk_receive_queue);
+ if (sk->sk_prot->memory_allocated && sk->sk_type != SOCK_STREAM)
+ __skb_queue_purge_and_sub_memory_allocated(sk,
+ &sk->sk_receive_queue);
+ else
+ __skb_queue_purge(&sk->sk_receive_queue);
+
__skb_queue_purge(&sk->sk_error_queue);
if (sk->sk_type == SOCK_STREAM && sk->sk_state != TCP_CLOSE) {
^ permalink raw reply [flat|nested] 8+ messages in thread* [PATCH 4/4] UDP memory accounting and limitation(take 5): memory limitation
2007-10-12 12:00 [PATCH 0/4]UDP memory accounting and limitation(take 5) Satoshi OSHIMA
` (2 preceding siblings ...)
2007-10-12 12:10 ` [PATCH 3/4] UDP memory accounting and limitation(take 5): memory accounting Satoshi OSHIMA
@ 2007-10-12 12:11 ` Satoshi OSHIMA
2007-10-15 10:43 ` Herbert Xu
3 siblings, 1 reply; 8+ messages in thread
From: Satoshi OSHIMA @ 2007-10-12 12:11 UTC (permalink / raw)
To: David Miller, netdev
Cc: Hideo AOKI, Yumiko SUGITA, "青木@RedHat",
Andi Kleen, Evgeniy Polyakov, Herbert Xu, Stephen Hemminger,
吉藤 英明
This patch introduces memory limitation for UDP.
signed-off-by: Satoshi Oshima <satoshi.oshima.fk@hitachi.com>
signed-off-by: Hideo Aoki <haoki@redhat.com>
Index: 2.6.23-udp_limit/include/net/udp.h
===================================================================
--- 2.6.23-udp_limit.orig/include/net/udp.h
+++ 2.6.23-udp_limit/include/net/udp.h
@@ -65,7 +65,10 @@ extern rwlock_t udp_hash_lock;
extern struct proto udp_prot;
+/* Used by memory accounting and capping */
+#define UDP_MIN_SKB_PAGES 4096
extern atomic_t udp_memory_allocated;
+extern int sysctl_udp_mem;
struct sk_buff;
Index: 2.6.23-udp_limit/net/ipv4/udp.c
===================================================================
--- 2.6.23-udp_limit.orig/net/ipv4/udp.c
+++ 2.6.23-udp_limit/net/ipv4/udp.c
@@ -114,6 +114,7 @@ struct hlist_head udp_hash[UDP_HTABLE_SI
DEFINE_RWLOCK(udp_hash_lock);
atomic_t udp_memory_allocated;
+int sysctl_udp_mem = UDP_MIN_SKB_PAGES;
static int udp_port_rover;
@@ -1016,6 +1017,16 @@ int udp_queue_rcv_skb(struct sock * sk,
goto drop;
}
+ if (sk->sk_prot->sysctl_mem[0] > UDP_MIN_SKB_PAGES) {
+ if ((atomic_read(sk->sk_prot->memory_allocated)
+ + sk_datagram_pages(skb->truesize))
+ >= sk->sk_prot->sysctl_mem[0]) {
+ UDP_INC_STATS_BH(UDP_MIB_RCVBUFERRORS,
+ up->pcflag);
+ goto drop;
+ }
+ }
+
if ((rc = sock_queue_rcv_skb(sk,skb)) < 0) {
/* Note that an ENOMEM error is charged twice */
if (rc == -ENOMEM)
@@ -1451,6 +1462,7 @@ struct proto udp_prot = {
.unhash = udp_lib_unhash,
.get_port = udp_v4_get_port,
.memory_allocated = &udp_memory_allocated,
+ .sysctl_mem = &sysctl_udp_mem,
.obj_size = sizeof(struct udp_sock),
#ifdef CONFIG_COMPAT
.compat_setsockopt = compat_udp_setsockopt,
Index: 2.6.23-udp_limit/net/ipv4/sysctl_net_ipv4.c
===================================================================
--- 2.6.23-udp_limit.orig/net/ipv4/sysctl_net_ipv4.c
+++ 2.6.23-udp_limit/net/ipv4/sysctl_net_ipv4.c
@@ -17,6 +17,7 @@
#include <net/ip.h>
#include <net/route.h>
#include <net/tcp.h>
+#include <net/udp.h>
#include <net/cipso_ipv4.h>
/* From af_inet.c */
@@ -25,6 +26,7 @@ extern int sysctl_ip_nonlocal_bind;
#ifdef CONFIG_SYSCTL
static int zero;
static int tcp_retr1_max = 255;
+static int udp_mem_min = UDP_MIN_SKB_PAGES;
static int ip_local_port_range_min[] = { 1, 1 };
static int ip_local_port_range_max[] = { 65535, 65535 };
#endif
@@ -599,6 +601,16 @@ ctl_table ipv4_table[] = {
.proc_handler = &proc_dointvec
},
{
+ .ctl_name = CTL_UNNUMBERED,
+ .procname = "udp_mem",
+ .data = &sysctl_udp_mem,
+ .maxlen = sizeof(sysctl_udp_mem),
+ .mode = 0644,
+ .proc_handler = &proc_dointvec_minmax,
+ .strategy = &sysctl_intvec,
+ .extra1 = &udp_mem_min
+ },
+ {
.ctl_name = NET_TCP_APP_WIN,
.procname = "tcp_app_win",
.data = &sysctl_tcp_app_win,
Index: 2.6.23-udp_limit/net/ipv4/ip_output.c
===================================================================
--- 2.6.23-udp_limit.orig/net/ipv4/ip_output.c
+++ 2.6.23-udp_limit/net/ipv4/ip_output.c
@@ -75,6 +75,7 @@
#include <net/icmp.h>
#include <net/checksum.h>
#include <net/inetpeer.h>
+#include <net/udp.h>
#include <linux/igmp.h>
#include <linux/netfilter_ipv4.h>
#include <linux/netfilter_bridge.h>
@@ -699,6 +700,21 @@ csum_page(struct page *page, int offset,
return csum;
}
+static inline int __ip_check_max_skb_pages(struct sock *sk, int size)
+{
+ switch(sk->sk_protocol) {
+ case IPPROTO_UDP:
+ if (sk->sk_prot->sysctl_mem[0] > UDP_MIN_SKB_PAGES)
+ if (atomic_read(sk->sk_prot->memory_allocated)+size
+ >= sk->sk_prot->sysctl_mem[0])
+ return -ENOBUFS;
+ /* Fall through */
+ default:
+ break;
+ }
+ return 0;
+}
+
static inline int ip_ufo_append_data(struct sock *sk,
int getfrag(void *from, char *to, int offset, int len,
int odd, struct sk_buff *skb),
@@ -910,6 +926,12 @@ alloc_new_skb:
if (datalen == length + fraggap)
alloclen += rt->u.dst.trailer_len;
+ err = __ip_check_max_skb_pages(sk,
+ sk_datagram_pages(SKB_DATA_ALIGN(alloclen + hh_len + 15)
+ + sizeof(struct sk_buff)));
+ if (err)
+ goto error;
+
if (transhdrlen) {
skb = sock_alloc_send_skb(sk,
alloclen + hh_len + 15,
@@ -1009,6 +1031,11 @@ alloc_new_skb:
frag = &skb_shinfo(skb)->frags[i];
}
} else if (i < MAX_SKB_FRAGS) {
+ err = __ip_check_max_skb_pages(sk,
+ sk_datagram_pages(PAGE_SIZE));
+ if (err)
+ goto error;
+
if (atomic_read(&sk->sk_wmem_alloc) + PAGE_SIZE
> 2 * sk->sk_sndbuf) {
err = -ENOBUFS;
@@ -1126,6 +1153,12 @@ ssize_t ip_append_page(struct sock *sk,
fraggap = skb_prev->len - maxfraglen;
alloclen = fragheaderlen + hh_len + fraggap + 15;
+
+ err = __ip_check_max_skb_pages(sk,
+ sk_datagram_pages(alloclen + sizeof(struct sk_buff)));
+ if (err)
+ goto error;
+
skb = sock_wmalloc(sk, alloclen, 1, sk->sk_allocation);
if (unlikely(!skb)) {
err = -ENOBUFS;
Index: 2.6.23-udp_limit/Documentation/networking/ip-sysctl.txt
===================================================================
--- 2.6.23-udp_limit.orig/Documentation/networking/ip-sysctl.txt
+++ 2.6.23-udp_limit/Documentation/networking/ip-sysctl.txt
@@ -439,6 +439,14 @@ tcp_dma_copybreak - INTEGER
and CONFIG_NET_DMA is enabled.
Default: 4096
+UDP variables:
+
+udp_mem - INTERGER
+ Number of pages allowed for queueing by all UDP sockets.
+ Minimal value is 4096. If 4096 is set, UDP memory will not
+ be limited.
+ Default: 4096
+
CIPSOv4 Variables:
cipso_cache_enable - BOOLEAN
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH 4/4] UDP memory accounting and limitation(take 5): memory limitation
2007-10-12 12:11 ` [PATCH 4/4] UDP memory accounting and limitation(take 5): memory limitation Satoshi OSHIMA
@ 2007-10-15 10:43 ` Herbert Xu
2007-10-17 4:06 ` Hideo AOKI
0 siblings, 1 reply; 8+ messages in thread
From: Herbert Xu @ 2007-10-15 10:43 UTC (permalink / raw)
To: Satoshi OSHIMA
Cc: David Miller, netdev, Hideo AOKI, Yumiko SUGITA,
"青木@RedHat", Andi Kleen, Evgeniy Polyakov,
Stephen Hemminger, 吉藤 英明
On Fri, Oct 12, 2007 at 09:11:27PM +0900, Satoshi OSHIMA wrote:
>
> +static inline int __ip_check_max_skb_pages(struct sock *sk, int size)
> +{
> + switch(sk->sk_protocol) {
> + case IPPROTO_UDP:
> + if (sk->sk_prot->sysctl_mem[0] > UDP_MIN_SKB_PAGES)
> + if (atomic_read(sk->sk_prot->memory_allocated)+size
> + >= sk->sk_prot->sysctl_mem[0])
> + return -ENOBUFS;
> + /* Fall through */
> + default:
> + break;
> + }
> + return 0;
> +}
Since you're not doing a per-user limit, you must give each
socket a minimum even when the total exceeds your threshold.
Otherwise any local user can trivially DoS the whole system.
> +UDP variables:
> +
> +udp_mem - INTERGER
> + Number of pages allowed for queueing by all UDP sockets.
> + Minimal value is 4096. If 4096 is set, UDP memory will not
> + be limited.
> + Default: 4096
This seems to be a rather confusing setup. We don't set a
minimum for TCP so is this really necessary?
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH 4/4] UDP memory accounting and limitation(take 5): memory limitation
2007-10-15 10:43 ` Herbert Xu
@ 2007-10-17 4:06 ` Hideo AOKI
2007-10-17 4:23 ` Herbert Xu
0 siblings, 1 reply; 8+ messages in thread
From: Hideo AOKI @ 2007-10-17 4:06 UTC (permalink / raw)
To: Herbert Xu
Cc: Satoshi OSHIMA, David Miller, netdev, Hideo AOKI, Yumiko SUGITA,
Andi Kleen, Evgeniy Polyakov, Stephen Hemminger, yoshfuji
Herbert Xu wrote:
> On Fri, Oct 12, 2007 at 09:11:27PM +0900, Satoshi OSHIMA wrote:
>> +static inline int __ip_check_max_skb_pages(struct sock *sk, int size)
>> +{
>> + switch(sk->sk_protocol) {
>> + case IPPROTO_UDP:
>> + if (sk->sk_prot->sysctl_mem[0] > UDP_MIN_SKB_PAGES)
>> + if (atomic_read(sk->sk_prot->memory_allocated)+size
>> + >= sk->sk_prot->sysctl_mem[0])
>> + return -ENOBUFS;
>> + /* Fall through */
>> + default:
>> + break;
>> + }
>> + return 0;
>> +}
>
> Since you're not doing a per-user limit, you must give each
> socket a minimum even when the total exceeds your threshold.
>
> Otherwise any local user can trivially DoS the whole system.
>
>> +UDP variables:
>> +
>> +udp_mem - INTERGER
>> + Number of pages allowed for queueing by all UDP sockets.
>> + Minimal value is 4096. If 4096 is set, UDP memory will not
>> + be limited.
>> + Default: 4096
>
> This seems to be a rather confusing setup. We don't set a
> minimum for TCP so is this really necessary?
Hello Herbert,
Thank you so much for your comments.
I'm going to fix them in next take patch set.
Regards,
Hideo
--
Hitachi Computer Products (America) Inc.
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH 4/4] UDP memory accounting and limitation(take 5): memory limitation
2007-10-17 4:06 ` Hideo AOKI
@ 2007-10-17 4:23 ` Herbert Xu
0 siblings, 0 replies; 8+ messages in thread
From: Herbert Xu @ 2007-10-17 4:23 UTC (permalink / raw)
To: Hideo AOKI
Cc: Satoshi OSHIMA, David Miller, netdev, Hideo AOKI, Yumiko SUGITA,
Andi Kleen, Evgeniy Polyakov, Stephen Hemminger, yoshfuji
On Wed, Oct 17, 2007 at 12:06:40AM -0400, Hideo AOKI wrote:
>
> Thank you so much for your comments.
>
> I'm going to fix them in next take patch set.
Thank you!
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 8+ messages in thread