[PATCH nf 1/1] ipvs: bound LBLCR cache growth

ip_vs_lblcr_new() creates a cache entry for every previously unseen
destination address. The table's max_size only tells the periodic
collector to reclaim entries after the cache has already exceeded the
limit. It does not reclaim entries that the attacker continues to use.

Reject new cache entries at max_size. The scheduler's existing fallback
continues to use the selected destination when cache creation fails, so
new traffic stays serviceable without growing the table.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: [email protected]
Reported-by: Vega <[email protected]>
Signed-off-by: Zhiling Zou <[email protected]>
---
 net/netfilter/ipvs/ip_vs_lblcr.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/netfilter/ipvs/ip_vs_lblcr.c b/net/netfilter/ipvs/ip_vs_lblcr.c
index f53f05ceea36f..91fa39edec0b5 100644
--- a/net/netfilter/ipvs/ip_vs_lblcr.c
+++ b/net/netfilter/ipvs/ip_vs_lblcr.c
@@ -363,6 +363,9 @@ ip_vs_lblcr_new(struct ip_vs_lblcr_table *tbl, const union nf_inet_addr *daddr,
 
 	en = ip_vs_lblcr_get(af, tbl, daddr);
 	if (!en) {
+		if (atomic_read(&tbl->entries) >= tbl->max_size)
+			return NULL;
+
 		en = kmalloc_obj(*en, GFP_ATOMIC);
 		if (!en)
 			return NULL;
-- 
2.43.0