On Tue, Jul 23, 2024 at 12:32:50PM +0100, Kerin Millar wrote:
> On Tue, 23 Jul 2024, at 10:39 AM, Pablo Neira Ayuso wrote:
> > On Tue, Jul 23, 2024 at 09:24:39AM +0200, Slavko wrote:
> > [...]
> >> (The host has >6 GB of free RAM, the list has ~1700 items)
> >>
> >> Initially i blame IP duplicates in downloaded list of IPs, but that was
> >> unrelated to this error. When i remove the first "add" and "delete"
> >> lines from script (thus just one "add"), it works. After initial fill it
> >> works with all three commands (add+delete+add) on already filled set
> >> and even when i flush that set, it still works. Only first fill (after
> >> boot) ends with that error.
> >>
> >> When i delete and create that set, i got "Out of memory" again, the set
> >> is defined as::
> >>
> >> table inet fw4 {
> >> set myset {
> >> type ipv4_addr
> >> last counter
> >> timeout 2d
> >> }
> >> }
> >>
> >> I tried to add "size" into it, but that doesn't help.
> >>
> >> I roughly remember, that i read something about some memory limit in
> >> container (i am not in container), but i am not able to find that
> >> again to check if that is problem.
> >>
> >> Please, what can cause that initial fill error, how i can debug/solve
> >> it?
> >
> > Kernel is likely missing this patch:
> >
> > commit fa23e0d4b756d25829e124d6b670a4c6bbd4bf7e
> > Author: Florian Westphal <fw@xxxxxxxxx>
> > Date: Wed May 8 14:52:47 2024 +0200
> >
> > netfilter: nf_tables: allow clone callbacks to sleep
>
> Would it be safe to backport the following two commits to linux-6.6.y in isolation?
>
> 3c13725f43dcf43ad8a9bcd6a9f12add19a8f93e (bail out if stateful expression provides no .clone)
> fa23e0d4b756d25829e124d6b670a4c6bbd4bf7e (allow clone callbacks to sleep)
I have enqueued those for -stable submission.
