Previously, the lower bound of INTERVAL_PROBE_TIME_MS was capped at 1s by commit ed6cd6a17896 ("net, neigh: Set lower cap for neigh_managed_work rearming"). Later, commit 211da42eaa45 ("net, neigh: introduce interval_probe_time_ms for periodic probe") changed the limit to 1ms. The limit actually did not work but was fixed with netlink_range_validation by commit 6d79b223ec44 ("neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS."). neigh_table is now per-netns, and a user could hog CPU by setting INTERVAL_PROBE_TIME_MS to a small value. Let's floor the value at 1 second. Suggested-by: Ido Schimmel Link: https://lore.kernel.org/netdev/20260902143023.GA3966681@shredder/ Signed-off-by: Kuniyuki Iwashima --- Documentation/netlink/specs/rt-neigh.yaml | 2 +- Documentation/networking/ip-sysctl.rst | 2 +- net/core/neighbour.c | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Documentation/netlink/specs/rt-neigh.yaml b/Documentation/netlink/specs/rt-neigh.yaml index c8e55c98d564..7929e667cc7a 100644 --- a/Documentation/netlink/specs/rt-neigh.yaml +++ b/Documentation/netlink/specs/rt-neigh.yaml @@ -342,7 +342,7 @@ attribute-sets: name: interval-probe-time-ms type: u64 checks: - min: 1 + min: 1000 max: 86400000 operations: diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst index 685c84cf543d..b00bd77363d7 100644 --- a/Documentation/networking/ip-sysctl.rst +++ b/Documentation/networking/ip-sysctl.rst @@ -248,7 +248,7 @@ neigh/default/unres_qlen - INTEGER neigh/default/interval_probe_time_ms - INTEGER The probe interval for neighbor entries with NTF_MANAGED flag, - the min value is 1, and the max value is 86400000 (1 day). + the min value is 1000 (1s), and the max value is 86400000 (1 day). Default: 5000 diff --git a/net/core/neighbour.c b/net/core/neighbour.c index 6b0569aa5d64..92e3c83c0fe5 100644 --- a/net/core/neighbour.c +++ b/net/core/neighbour.c @@ -2438,7 +2438,7 @@ static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = { #define NTBL_PARM_MS_MAX (24 * 60 * 60 * MSEC_PER_SEC) static const struct netlink_range_validation nl_ntbl_parm_ms_range = { - .min = 1, + .min = 1000, .max = NTBL_PARM_MS_MAX, }; @@ -3701,7 +3701,7 @@ static int neigh_proc_dointvec_ms_jiffies_positive(const struct ctl_table *ctl, struct ctl_table tmp = *ctl; int ret, min, max; - min = msecs_to_jiffies(1); + min = HZ; max = msecs_to_jiffies(NTBL_PARM_MS_MAX); tmp.extra1 = &min; -- 2.56.0.385.gd3acb90ef8-goog