On 07/31/2018 05:05 PM, Florian Westphal wrote: > Georgi Nikolov <gnikolov@xxxxxxxxxxx> wrote: >>> No, I think that's rather for the netfilter folks to decide. However, it >>> seems there has been the debate already [1] and it was not found. The >>> conclusion was that __GFP_NORETRY worked fine before, so it should work >>> again after it's added back. But now we know that it doesn't... >>> >>> [1] https://lore.kernel.org/lkml/20180130140104.GE21609@xxxxxxxxxxxxxx/T/#u >> Yes i see. I will add Florian Westphal to CC list. netfilter-devel is >> already in this list so probably have to wait for their opinion. > It hasn't changed, I think having OOM killer zap random processes > just because userspace wants to import large iptables ruleset is not a > good idea. And what about passing GFP_NORETRY only above some reasonable threshold? Or situation has to be handled in userspace. Regards, -- Georgi Nikolov
