Georgi Nikolov <gnikolov@xxxxxxxxxxx> wrote: > > No, I think that's rather for the netfilter folks to decide. However, it > > seems there has been the debate already [1] and it was not found. The > > conclusion was that __GFP_NORETRY worked fine before, so it should work > > again after it's added back. But now we know that it doesn't... > > > > [1] https://lore.kernel.org/lkml/20180130140104.GE21609@xxxxxxxxxxxxxx/T/#u > > Yes i see. I will add Florian Westphal to CC list. netfilter-devel is > already in this list so probably have to wait for their opinion. It hasn't changed, I think having OOM killer zap random processes just because userspace wants to import large iptables ruleset is not a good idea.
