ip_vs_lblcr_new() creates a cache entry for every previously unseen destination address. The table's max_size only tells the periodic collector to reclaim entries after the cache has already exceeded the limit. It does not reclaim entries that the attacker continues to use. Reject new cache entries at max_size. The scheduler's existing fallback continues to use the selected destination when cache creation fails, so new traffic stays serviceable without growing the table. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Reported-by: Vega Signed-off-by: Zhiling Zou --- net/netfilter/ipvs/ip_vs_lblcr.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/ipvs/ip_vs_lblcr.c b/net/netfilter/ipvs/ip_vs_lblcr.c index f53f05ceea36f..91fa39edec0b5 100644 --- a/net/netfilter/ipvs/ip_vs_lblcr.c +++ b/net/netfilter/ipvs/ip_vs_lblcr.c @@ -363,6 +363,9 @@ ip_vs_lblcr_new(struct ip_vs_lblcr_table *tbl, const union nf_inet_addr *daddr, en = ip_vs_lblcr_get(af, tbl, daddr); if (!en) { + if (atomic_read(&tbl->entries) >= tbl->max_size) + return NULL; + en = kmalloc_obj(*en, GFP_ATOMIC); if (!en) return NULL; -- 2.43.0