From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 31ADDC433F5 for ; Tue, 1 Mar 2022 18:09:23 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id A69BD8D0002; Tue, 1 Mar 2022 13:09:22 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id A180A8D0001; Tue, 1 Mar 2022 13:09:22 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 907638D0002; Tue, 1 Mar 2022 13:09:22 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0064.hostedemail.com [216.40.44.64]) by kanga.kvack.org (Postfix) with ESMTP id 82BA38D0001 for ; Tue, 1 Mar 2022 13:09:22 -0500 (EST) Received: from smtpin30.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 387B697909 for ; Tue, 1 Mar 2022 18:09:22 +0000 (UTC) X-FDA: 79196604564.30.0C4A3C7 Received: from mail-pf1-f202.google.com (mail-pf1-f202.google.com [209.85.210.202]) by imf08.hostedemail.com (Postfix) with ESMTP id A81CA160006 for ; Tue, 1 Mar 2022 18:09:21 +0000 (UTC) Received: by mail-pf1-f202.google.com with SMTP id h128-20020a625386000000b004f10a219a98so10242933pfb.0 for ; Tue, 01 Mar 2022 10:09:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=c0dbKsIdJk+qHikmULBiKTfiJVqKnwC4QHGDZyjez5c=; b=c0CY58qwtC+TXIekm9RwFv9mu85r2tPUGknQ7lP4mK62Dv4iMMRx2WwvSmym01I/rt x4a6ZJclsNaz5N4C9aAN1fTg3nik/jMjRCN73yPx/fcUzal7hJfreK83kZc1NY0MZB8d EVJ5QjIoD9KxKwfsA+8JKkej0did5a3WXbLWwN8dsYyndAwDQx6OXWDTJHo5LnA6Vgxu IQjaqRQeuuKMxfjT0X9hu5QyWkWFwifmszCxuDSnaYBgYLDf8fhU2Ip32/r41UnVH3Su cAjn4su1Pwdt+j2mgeQqJOJ/z9T8D8s/rO0Ku6ZgWJjzH3C60V6N8sBqCdpXtVzALVJh JN5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=c0dbKsIdJk+qHikmULBiKTfiJVqKnwC4QHGDZyjez5c=; b=oH2Qhnqkmf5Y57/F7p3ht+I4NTANrrVcxD2oqzGPSzb7+gEnAuYDNRyh5X1y8vP7gn srXLpKZtD3FYspbdciJT8DUeepxF38IhAVhd1lNXkn0ugT4L2CZ1FRWul0IR5yhTojXQ e0qbOggu0GODWOw0GeZRDIUf4GodToEb6hdZj6rONcgJ3ThUsq7HQoZra2GmiMHsMWdV 4+ZBmvV2CJm8h/i7dcCOi5YHjpu6HHHejnS9C0D5qfTrXKBcnkGYNezA0yxgw2Yqg41B NE71hf1/ep97bvvfP7ROzisojTBhLTET8YWnob/Kl0+86DGHvbJ1JJaPTAOjYMkM2eqF TnRg== X-Gm-Message-State: AOAM5316IGK5ks9fyV5xFMj/d5oq8wxTt0f/oTgOr3oyHmIfwOjrhTlX Nz7HEHDsxk3siDE9iSNPV52KBo2nf1AMlA== X-Google-Smtp-Source: ABdhPJz3IEoUnP+YY4bGnTx41NXJkSuyhuQFFA6sFxSnDvKBjPMaNwdb8qpS6y54oVGPkAvATMxVOHwB6qwIAA== X-Received: from shakeelb.svl.corp.google.com ([2620:15c:2cd:202:6e75:6cb3:9d81:deae]) (user=shakeelb job=sendgmr) by 2002:a17:902:860a:b0:14b:341e:5ffb with SMTP id f10-20020a170902860a00b0014b341e5ffbmr26428871plo.6.1646158160480; Tue, 01 Mar 2022 10:09:20 -0800 (PST) Date: Tue, 1 Mar 2022 10:09:17 -0800 In-Reply-To: Message-Id: <20220301180917.tkibx7zpcz2faoxy@google.com> Mime-Version: 1.0 References: Subject: Re: [PATCH RFC] net: memcg accounting for veth devices From: Shakeel Butt To: Luis Chamberlain Cc: Vasily Averin , "Eric W. Biederman" , Vlastimil Babka , NeilBrown , Michal Hocko , Roman Gushchin , Linux MM , netdev@vger.kernel.org, "David S. Miller" , Jakub Kicinski , Tejun Heo , Greg Kroah-Hartman , Eric Dumazet , Kees Cook , Hideaki YOSHIFUJI , David Ahern , linux-kernel@vger.kernel.org, kernel@openvz.org Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes X-Rspamd-Server: rspam10 X-Rspam-User: X-Stat-Signature: 71shuktcmdq87abre45urw9tdzgcckax Authentication-Results: imf08.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=c0CY58qw; spf=pass (imf08.hostedemail.com: domain of 3UGEeYggKCKMVKDNHHOEJRRJOH.FRPOLQXa-PPNYDFN.RUJ@flex--shakeelb.bounces.google.com designates 209.85.210.202 as permitted sender) smtp.mailfrom=3UGEeYggKCKMVKDNHHOEJRRJOH.FRPOLQXa-PPNYDFN.RUJ@flex--shakeelb.bounces.google.com; dmarc=pass (policy=reject) header.from=google.com X-Rspamd-Queue-Id: A81CA160006 X-HE-Tag: 1646158161-967785 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, Feb 28, 2022 at 06:36:58AM -0800, Luis Chamberlain wrote: > On Mon, Feb 28, 2022 at 10:17:16AM +0300, Vasily Averin wrote: > > Following one-liner running inside memcg-limited container consumes > > huge number of host memory and can trigger global OOM. > > > > for i in `seq 1 xxx` ; do ip l a v$i type veth peer name vp$i ; done > > > > Patch accounts most part of these allocations and can protect host. > > ---[cut]--- > > It is not polished, and perhaps should be splitted. > > obviously it affects other kind of netdevices too. > > Unfortunately I'm not sure that I will have enough time to handle it > properly > > and decided to publish current patch version as is. > > OpenVz workaround it by using per-container limit for number of > > available netdevices, but upstream does not have any kind of > > per-container configuration. > > ------ > Should this just be a new ucount limit on kernel/ucount.c and have veth > use something like inc_ucount(current_user_ns(), current_euid(), > UCOUNT_VETH)? > This might be abusing ucounts though, not sure, Eric? For admins of systems running multiple workloads, there is no easy way to set such limits for each workload. Some may genuinely need more veth than others. From admin's perspective it is preferred to have minimal knobs to set and if these objects are charged to memcg then the memcg limits would limit them. There was similar situation for inotify instances where fs sysctl inotify/max_user_instances already limits the inotify instances but we memcg charged them to not worry about setting such limits. See ac7b79fd190b ("inotify, memcg: account inotify instances to kmemcg").