From: Mikael Pettersson <mikpelinux@gmail.com> To: Andi Kleen <ak@linux.intel.com> Cc: Michal Hocko <mhocko@kernel.org>, linux-mm@kvack.org, "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, linux-fsdevel@vger.kernel.org, Linux API <linux-api@vger.kernel.org> Subject: Re: [PATCH] mm: disable `vm.max_map_count' sysctl limit Date: Mon, 27 Nov 2017 20:36:55 +0100 [thread overview] Message-ID: <CAM43=SPgi9aXGFWYwpqeN26s5aUTdk7F6C+5wgrQOTq2QmvTzA@mail.gmail.com> (raw) In-Reply-To: <87vahv8whv.fsf@linux.intel.com> On Mon, Nov 27, 2017 at 6:25 PM, Andi Kleen <ak@linux.intel.com> wrote: > It's an arbitrary scaling limit on the how many mappings the process > has. The more memory you have the bigger a problem it is. We've > ran into this problem too on larger systems. > > The reason the limit was there originally because it allows a DoS > attack against the kernel by filling all unswappable memory up with VMAs. > > The old limit was designed for much smaller systems than we have > today. > > There needs to be some limit, but it should be on the number of memory > pinned by the VMAs, and needs to scale with the available memory, > so that large systems are not penalized. Fully agreed. One problem with the current limit is that number of VMAs is only weakly related to the amount of memory one has mapped, and is also prone to grow due to memory fragmentation. I've seen processes differ by 3X number of VMAs, even though they ran the same code and had similar memory sizes; they only differed on how long they had been running and which servers they ran on (and how long those had been up). > Unfortunately just making it part of the existing mlock limit could > break some existing setups which max out the mlock limit with something > else. Maybe we need a new rlimit for this? > > -Andi
WARNING: multiple messages have this Message-ID (diff)
From: Mikael Pettersson <mikpelinux@gmail.com> To: Andi Kleen <ak@linux.intel.com> Cc: Michal Hocko <mhocko@kernel.org>, linux-mm@kvack.org, "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, linux-fsdevel@vger.kernel.org, Linux API <linux-api@vger.kernel.org> Subject: Re: [PATCH] mm: disable `vm.max_map_count' sysctl limit Date: Mon, 27 Nov 2017 20:36:55 +0100 [thread overview] Message-ID: <CAM43=SPgi9aXGFWYwpqeN26s5aUTdk7F6C+5wgrQOTq2QmvTzA@mail.gmail.com> (raw) In-Reply-To: <87vahv8whv.fsf@linux.intel.com> On Mon, Nov 27, 2017 at 6:25 PM, Andi Kleen <ak@linux.intel.com> wrote: > It's an arbitrary scaling limit on the how many mappings the process > has. The more memory you have the bigger a problem it is. We've > ran into this problem too on larger systems. > > The reason the limit was there originally because it allows a DoS > attack against the kernel by filling all unswappable memory up with VMAs. > > The old limit was designed for much smaller systems than we have > today. > > There needs to be some limit, but it should be on the number of memory > pinned by the VMAs, and needs to scale with the available memory, > so that large systems are not penalized. Fully agreed. One problem with the current limit is that number of VMAs is only weakly related to the amount of memory one has mapped, and is also prone to grow due to memory fragmentation. I've seen processes differ by 3X number of VMAs, even though they ran the same code and had similar memory sizes; they only differed on how long they had been running and which servers they ran on (and how long those had been up). > Unfortunately just making it part of the existing mlock limit could > break some existing setups which max out the mlock limit with something > else. Maybe we need a new rlimit for this? > > -Andi -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2017-11-27 19:37 UTC|newest] Thread overview: 47+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-11-26 16:09 [PATCH] mm: disable `vm.max_map_count' sysctl limit Mikael Pettersson 2017-11-26 16:09 ` Mikael Pettersson 2017-11-26 16:09 ` Mikael Pettersson 2017-11-27 10:12 ` Michal Hocko 2017-11-27 10:12 ` Michal Hocko 2017-11-27 16:22 ` Matthew Wilcox 2017-11-27 16:22 ` Matthew Wilcox 2017-11-27 19:28 ` Mikael Pettersson 2017-11-27 19:28 ` Mikael Pettersson 2017-11-27 19:28 ` Mikael Pettersson 2017-11-27 17:25 ` Andi Kleen 2017-11-27 17:25 ` Andi Kleen 2017-11-27 17:25 ` Andi Kleen 2017-11-27 18:32 ` Michal Hocko 2017-11-27 18:32 ` Michal Hocko 2017-11-27 18:32 ` Michal Hocko 2017-11-27 19:57 ` Michal Hocko 2017-11-27 19:57 ` Michal Hocko 2017-11-27 20:21 ` Andi Kleen 2017-11-27 20:21 ` Andi Kleen 2017-11-27 20:21 ` Andi Kleen 2017-11-27 20:52 ` Michal Hocko 2017-11-27 20:52 ` Michal Hocko 2017-11-27 19:36 ` Mikael Pettersson [this message] 2017-11-27 19:36 ` Mikael Pettersson 2017-11-27 19:18 ` Mikael Pettersson 2017-11-27 19:18 ` Mikael Pettersson 2017-11-27 19:18 ` Mikael Pettersson 2017-11-27 19:52 ` Michal Hocko 2017-11-27 19:52 ` Michal Hocko 2017-11-27 19:52 ` Michal Hocko 2017-11-27 23:26 ` John Hubbard 2017-11-27 23:26 ` John Hubbard 2017-11-27 23:26 ` John Hubbard 2017-11-27 23:26 ` John Hubbard 2017-11-28 8:12 ` Michal Hocko 2017-11-28 8:12 ` Michal Hocko 2017-11-29 5:14 ` John Hubbard 2017-11-29 5:14 ` John Hubbard 2017-11-29 5:14 ` John Hubbard 2017-11-29 8:32 ` Michal Hocko 2017-11-29 8:32 ` Michal Hocko 2017-11-29 8:32 ` Michal Hocko 2017-11-27 19:46 Alexey Dobriyan 2017-11-27 19:46 ` Alexey Dobriyan 2017-11-27 19:47 ` Alexey Dobriyan 2017-11-27 19:47 ` Alexey Dobriyan
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to='CAM43=SPgi9aXGFWYwpqeN26s5aUTdk7F6C+5wgrQOTq2QmvTzA@mail.gmail.com' \ --to=mikpelinux@gmail.com \ --cc=ak@linux.intel.com \ --cc=linux-api@vger.kernel.org \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=mhocko@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.