[v2] pipe: limit the per-user amount of pages allocated in pipes

Message ID	201601111226.u0BCQ1gv031473@mail.home.local (mailing list archive)
State	New, archived
Headers	show Return-Path: <linux-fsdevel-owner@kernel.org> Message-Id: <201601111226.u0BCQ1gv031473@mail.home.local> Date: Mon, Jan 11 09:56:23 2016 +0100 From: Willy Tarreau <w@1wt.eu> To: Alexander Viro <viro@zeniv.linux.org.uk> Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, Linus Torvalds <torvalds@linux-foundation.org>, socketpair@gmail.com, Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Subject: [PATCH v2] pipe: limit the per-user amount of pages allocated in pipes Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk

diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt index 88152f2..a9751b1 100644 --- a/Documentation/sysctl/fs.txt +++ b/Documentation/sysctl/fs.txt @@ -37,6 +37,7 @@ Currently, these files are in /proc/sys/fs: - suid_dumpable - super-max - super-nr +- user-max-pipe-pages ============================================================== @@ -234,6 +235,15 @@ allows you to. ============================================================== +user-max-pipe-pages: + +Maximum total number of pages a non-privileged user may allocate for pipes. +When this limit is reached, new pipes will be limited to a single page in size +in order to limit total memory usage. The default value allows to allocate up +to 1024 pipes at their default size. When set to 0, no limit is enforced. + +============================================================== + aio-nr & aio-max-nr: aio-nr shows the current system-wide number of asynchronous io diff --git a/fs/pipe.c b/fs/pipe.c index 42cf8dd..cc4874b 100644 --- a/fs/pipe.c +++ b/fs/pipe.c @@ -38,6 +38,9 @@ unsigned int pipe_max_size = 1048576; */ unsigned int pipe_min_size = PAGE_SIZE; +/* Maximum allocatable pages per user, matches default values */ +unsigned long user_max_pipe_pages = PIPE_DEF_BUFFERS * INR_OPEN_CUR; + /* * We use a start+len construction, which provides full use of the * allocated memory. @@ -583,20 +587,41 @@ pipe_fasync(int fd, struct file *filp, int on) return retval; } +static void account_pipe_buffers(struct pipe_inode_info *pipe, + unsigned long old, unsigned long new) +{ + atomic_long_add(new - old, &pipe->user->pipe_bufs); +} + +static bool too_many_pipe_buffers(struct user_struct *user) +{ + return user_max_pipe_pages && + atomic_long_read(&user->pipe_bufs) >= user_max_pipe_pages; +} + struct pipe_inode_info *alloc_pipe_info(void) { struct pipe_inode_info *pipe; pipe = kzalloc(sizeof(struct pipe_inode_info), GFP_KERNEL); if (pipe) { - pipe->bufs = kzalloc(sizeof(struct pipe_buffer) * PIPE_DEF_BUFFERS, GFP_KERNEL); + unsigned long pipe_bufs = PIPE_DEF_BUFFERS; + struct user_struct *user = get_current_user(); + + if (too_many_pipe_buffers(user)) + pipe_bufs = 1; + + pipe->bufs = kzalloc(sizeof(struct pipe_buffer) * pipe_bufs, GFP_KERNEL); if (pipe->bufs) { init_waitqueue_head(&pipe->wait); pipe->r_counter = pipe->w_counter = 1; - pipe->buffers = PIPE_DEF_BUFFERS; + pipe->buffers = pipe_bufs; + pipe->user = user; + account_pipe_buffers(pipe, 0, pipe_bufs); mutex_init(&pipe->mutex); return pipe; } + free_uid(user); kfree(pipe); } @@ -607,6 +632,8 @@ void free_pipe_info(struct pipe_inode_info *pipe) { int i; + account_pipe_buffers(pipe, pipe->buffers, 0); + free_uid(pipe->user); for (i = 0; i < pipe->buffers; i++) { struct pipe_buffer *buf = pipe->bufs + i; if (buf->ops) @@ -998,6 +1025,7 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages) memcpy(bufs + head, pipe->bufs, tail * sizeof(struct pipe_buffer)); } + account_pipe_buffers(pipe, pipe->buffers, nr_pages); pipe->curbuf = 0; kfree(pipe->bufs); pipe->bufs = bufs; @@ -1066,7 +1094,8 @@ long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg) if (!nr_pages) goto out; - if (!capable(CAP_SYS_RESOURCE) && size > pipe_max_size) { + if (!capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN) && + (size > pipe_max_size || too_many_pipe_buffers(pipe->user))) { ret = -EPERM; goto out; } diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h index eb8b8ac..a4cee7c 100644 --- a/include/linux/pipe_fs_i.h +++ b/include/linux/pipe_fs_i.h @@ -57,6 +57,7 @@ struct pipe_inode_info { struct fasync_struct *fasync_readers; struct fasync_struct *fasync_writers; struct pipe_buffer *bufs; + struct user_struct *user; }; /* @@ -123,6 +124,7 @@ void pipe_unlock(struct pipe_inode_info *); void pipe_double_lock(struct pipe_inode_info *, struct pipe_inode_info *); extern unsigned int pipe_max_size, pipe_min_size; +extern unsigned long user_max_pipe_pages; int pipe_proc_fn(struct ctl_table *, int, void __user *, size_t *, loff_t *); diff --git a/include/linux/sched.h b/include/linux/sched.h index fbf25f1..93643762 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -831,6 +831,7 @@ struct user_struct { #endif unsigned long locked_shm; /* How many pages of mlocked shm ? */ unsigned long unix_inflight; /* How many files in flight in unix sockets */ + atomic_long_t pipe_bufs; /* how many pages are allocated in pipe buffers */ #ifdef CONFIG_KEYS struct key *uid_keyring; /* UID specific keyring */ diff --git a/kernel/sysctl.c b/kernel/sysctl.c index dc6858d..a288edf 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -1735,6 +1735,13 @@ static struct ctl_table fs_table[] = { .proc_handler = &pipe_proc_fn, .extra1 = &pipe_min_size, }, + { + .procname = "user-max-pipe-pages", + .data = &user_max_pipe_pages, + .maxlen = sizeof(user_max_pipe_pages), + .mode = 0644, + .proc_handler = proc_doulongvec_minmax, + }, { } };

[v2] pipe: limit the per-user amount of pages allocated in pipes

Commit Message

Comments

Patch