On 07/31/2018 04:25 PM, Georgi Nikolov wrote: > On 07/31/2018 05:05 PM, Florian Westphal wrote: >> Georgi Nikolov <gnikolov@xxxxxxxxxxx> wrote: >>>> No, I think that's rather for the netfilter folks to decide. However, it >>>> seems there has been the debate already [1] and it was not found. The >>>> conclusion was that __GFP_NORETRY worked fine before, so it should work >>>> again after it's added back. But now we know that it doesn't... >>>> >>>> [1] https://lore.kernel.org/lkml/20180130140104.GE21609@xxxxxxxxxxxxxx/T/#u >>> Yes i see. I will add Florian Westphal to CC list. netfilter-devel is >>> already in this list so probably have to wait for their opinion. >> It hasn't changed, I think having OOM killer zap random processes >> just because userspace wants to import large iptables ruleset is not a >> good idea. > And what about passing GFP_NORETRY only above some reasonable threshold? What is the reasonable threshold? > Or situation has to be handled in userspace. How? > > Regards, > > -- > Georgi Nikolov >
