From: Peter Zijlstra <peterz@infradead.org>
To: Alessio Balsini <balsini@android.com>
Cc: mingo@kernel.org, juri.lelli@redhat.com,
linux-kernel@vger.kernel.org, dietmar.eggemann@arm.com,
luca.abeni@santannapisa.it, bristot@redhat.com,
dvyukov@google.com, tglx@linutronix.de, vpillai@digitalocean.com,
rostedt@goodmis.org, kernel-team@android.com
Subject: Re: [RFC][PATCH 01/13] sched/deadline: Impose global limits on sched_attr::sched_period
Date: Thu, 22 Aug 2019 18:51:25 +0200 [thread overview]
Message-ID: <20190822165125.GW2369@hirez.programming.kicks-ass.net> (raw)
In-Reply-To: <20190822122949.GA245353@google.com>
On Thu, Aug 22, 2019 at 01:29:49PM +0100, Alessio Balsini wrote:
> Yes, that's exactly what I meant!
> What about this refactoring?
Makes sense; and now I spot a race (and sched_rt_handler() from which I
copied this is susceptible too):
> +int sched_dl_period_handler(struct ctl_table *table, int write,
> + void __user *buffer, size_t *lenp,
> + loff_t *ppos)
> +{
> + unsigned int old_max, old_min;
> + static DEFINE_MUTEX(mutex);
> + int ret;
> +
> + mutex_lock(&mutex);
> + old_max = sysctl_sched_dl_period_max;
> + old_min = sysctl_sched_dl_period_min;
> +
> + ret = proc_douintvec(table, write, buffer, lenp, ppos);
Here the sysctl_* values have been changed, interleave with:
> + if (!ret && write) {
> + u64 max = (u64)sysctl_sched_dl_period_max * NSEC_PER_USEC;
> + u64 min = (u64)sysctl_sched_dl_period_min * NSEC_PER_USEC;
> +
> + if (min < 1ULL << DL_SCALE || max < min) {
> + sysctl_sched_dl_period_max = old_max;
> + sysctl_sched_dl_period_min = old_min;
> + ret = -EINVAL;
> + }
> + }
> + mutex_unlock(&mutex);
> +
> + return ret;
> +}
> @@ -2675,12 +2713,21 @@ bool __checkparam_dl(const struct sched_attr *attr)
> attr->sched_period & (1ULL << 63))
> return false;
>
> + period = attr->sched_period;
> + if (!period)
> + period = attr->sched_deadline;
> +
> /* runtime <= deadline <= period (if period != 0) */
> - if ((attr->sched_period != 0 &&
> - attr->sched_period < attr->sched_deadline) ||
> + if (period < attr->sched_deadline ||
> attr->sched_deadline < attr->sched_runtime)
> return false;
>
> + max = (u64)READ_ONCE(sysctl_sched_dl_period_max) * NSEC_PER_USEC;
> + min = (u64)READ_ONCE(sysctl_sched_dl_period_min) * NSEC_PER_USEC;
this, and we're using unvalidated numbers.
> + if (period < min || period > max)
> + return false;
> +
> return true;
> }
Something like the completely untested (again, sorry) below ought to
cure that I think; the same needs doing to sched_rt_handler() I'm
thinking.
---
Subject: sched/deadline: Impose global limits on sched_attr::sched_period
From: Alessio Balsini <balsini@android.com>
Date: Thu, 22 Aug 2019 13:29:49 +0100
There are two DoS scenarios with SCHED_DEADLINE related to
sched_attr::sched_period:
- since access-control only looks at utilization and density, a very
large period can allow a very large runtime, which in turn can
incur a very large latency to lower priority tasks.
- for very short periods we can end up spending more time programming
the hardware timer than actually running the task.
Mitigate these by imposing limits on the period.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Alessio Balsini <balsini@android.com>
Cc: rostedt@goodmis.org
Cc: mingo@kernel.org
Cc: luca.abeni@santannapisa.it
Cc: bristot@redhat.com
Cc: vpillai@digitalocean.com
Cc: kernel-team@android.com
Cc: juri.lelli@redhat.com
Cc: dietmar.eggemann@arm.com
Cc: dvyukov@google.com
Cc: tglx@linutronix.de
---
include/linux/sched/sysctl.h | 7 +++++
kernel/sched/deadline.c | 58 +++++++++++++++++++++++++++++++++++++++++--
kernel/sysctl.c | 14 ++++++++++
3 files changed, 77 insertions(+), 2 deletions(-)
--- a/include/linux/sched/sysctl.h
+++ b/include/linux/sched/sysctl.h
@@ -56,6 +56,13 @@ int sched_proc_update_handler(struct ctl
extern unsigned int sysctl_sched_rt_period;
extern int sysctl_sched_rt_runtime;
+extern unsigned int sysctl_sched_dl_period_max;
+extern unsigned int sysctl_sched_dl_period_min;
+
+extern int sched_dl_period_handler(struct ctl_table *table, int write,
+ void __user *buffer, size_t *lenp,
+ loff_t *ppos);
+
#ifdef CONFIG_UCLAMP_TASK
extern unsigned int sysctl_sched_uclamp_util_min;
extern unsigned int sysctl_sched_uclamp_util_max;
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -2633,6 +2633,49 @@ void __getparam_dl(struct task_struct *p
}
/*
+ * Default limits for DL period: on the top end we guard against small util
+ * tasks still getting ridiculous long effective runtimes, on the bottom end we
+ * guard against timer DoS.
+ */
+unsigned int sysctl_sched_dl_period_max = 1 << 22; /* ~4 seconds */
+unsigned int sysctl_sched_dl_period_min = 100; /* 100 us */
+
+int sched_dl_period_handler(struct ctl_table *table, int write,
+ void __user *buffer, size_t *lenp,
+ loff_t *ppos)
+{
+ unsigned int new_max, new_min;
+ struct ctl_table new_table;
+ static DEFINE_MUTEX(mutex);
+ int ret;
+
+ mutex_lock(&mutex);
+ new_max = sysctl_sched_dl_period_max;
+ new_min = sysctl_sched_dl_period_min;
+ new_table = *table;
+ if (new_table.data == &sysctl_sched_dl_period_max)
+ new_table.data = &new_max;
+ else
+ new_table.data = &new_min;
+
+ ret = proc_douintvec(&new_table, write, buffer, lenp, ppos);
+ if (!ret && write) {
+ u64 max = (u64)new_max * NSEC_PER_USEC;
+ u64 min = (u64)new_min * NSEC_PER_USEC;
+
+ if (min > 1ULL << DL_SCALE && max > min) {
+ WRITE_ONCE(sysctl_sched_dl_period_max, new_max);
+ WRITE_ONCE(sysctl_sched_dl_period_min, new_min);
+ } else {
+ ret = -EINVAL;
+ }
+ }
+ mutex_unlock(&mutex);
+
+ return ret;
+}
+
+/*
* This function validates the new parameters of a -deadline task.
* We ask for the deadline not being zero, and greater or equal
* than the runtime, as well as the period of being zero or
@@ -2644,6 +2687,8 @@ void __getparam_dl(struct task_struct *p
*/
bool __checkparam_dl(const struct sched_attr *attr)
{
+ u64 period, max, min;
+
/* special dl tasks don't actually use any parameter */
if (attr->sched_flags & SCHED_FLAG_SUGOV)
return true;
@@ -2667,12 +2712,21 @@ bool __checkparam_dl(const struct sched_
attr->sched_period & (1ULL << 63))
return false;
+ period = attr->sched_period;
+ if (!period)
+ period = attr->sched_deadline;
+
/* runtime <= deadline <= period (if period != 0) */
- if ((attr->sched_period != 0 &&
- attr->sched_period < attr->sched_deadline) ||
+ if (period < attr->sched_deadline ||
attr->sched_deadline < attr->sched_runtime)
return false;
+ max = (u64)READ_ONCE(sysctl_sched_dl_period_max) * NSEC_PER_USEC;
+ min = (u64)READ_ONCE(sysctl_sched_dl_period_min) * NSEC_PER_USEC;
+
+ if (period < min || period > max)
+ return false;
+
return true;
}
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -443,6 +443,20 @@ static struct ctl_table kern_table[] = {
.proc_handler = sched_rt_handler,
},
{
+ .procname = "sched_deadline_period_max_us",
+ .data = &sysctl_sched_dl_period_max,
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = sched_dl_period_handler,
+ },
+ {
+ .procname = "sched_deadline_period_min_us",
+ .data = &sysctl_sched_dl_period_min,
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = sched_dl_period_handler,
+ },
+ {
.procname = "sched_rr_timeslice_ms",
.data = &sysctl_sched_rr_timeslice,
.maxlen = sizeof(int),
next prev parent reply other threads:[~2019-08-22 16:52 UTC|newest]
Thread overview: 63+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-26 14:54 [RFC][PATCH 00/13] SCHED_DEADLINE server infrastructure Peter Zijlstra
2019-07-26 14:54 ` [RFC][PATCH 01/13] sched/deadline: Impose global limits on sched_attr::sched_period Peter Zijlstra
2019-07-29 8:57 ` Juri Lelli
2019-07-29 11:45 ` Daniel Bristot de Oliveira
2019-08-02 17:21 ` Alessio Balsini
2019-08-05 11:53 ` Peter Zijlstra
2019-08-22 12:29 ` Alessio Balsini
2019-08-22 16:51 ` Peter Zijlstra [this message]
2019-08-31 14:41 ` Alessio Balsini
2019-09-02 9:16 ` Peter Zijlstra
2019-09-02 12:31 ` Peter Zijlstra
2019-09-04 10:16 ` Steven Rostedt
2019-09-04 11:30 ` Peter Zijlstra
2019-09-04 13:24 ` Joel Fernandes
2019-09-04 14:11 ` Will Deacon
2019-09-04 14:35 ` Joel Fernandes
2019-09-04 15:52 ` Peter Zijlstra
2019-10-23 17:17 ` [PATCH 4.4 4.9 4.14] loop: Add LOOP_SET_DIRECT_IO to compat ioctl Alessio Balsini
2019-10-23 17:22 ` Alessio Balsini
2019-10-25 0:17 ` Sasha Levin
2020-05-20 18:38 ` [RFC][PATCH 01/13] sched/deadline: Impose global limits on sched_attr::sched_period Juri Lelli
2020-05-21 13:45 ` Daniel Bristot de Oliveira
2020-06-16 12:21 ` [tip: sched/core] " tip-bot2 for Peter Zijlstra
2019-07-26 14:54 ` [RFC][PATCH 02/13] stop_machine: Fix stop_cpus_in_progress ordering Peter Zijlstra
2019-07-30 13:16 ` Phil Auld
2019-07-30 13:22 ` Steven Rostedt
2019-07-26 14:54 ` [RFC][PATCH 03/13] sched: Fix kerneldoc comment for ia64_set_curr_task Peter Zijlstra
2019-07-26 14:54 ` [RFC][PATCH 04/13] sched/{rt,deadline}: Fix set_next_task vs pick_next_task Peter Zijlstra
2019-07-29 9:25 ` Juri Lelli
2019-07-29 11:15 ` Peter Zijlstra
2019-07-29 11:27 ` Juri Lelli
2019-07-29 13:04 ` Peter Zijlstra
2019-07-29 13:17 ` Juri Lelli
2019-07-29 14:40 ` Peter Zijlstra
2019-07-26 14:54 ` [RFC][PATCH 05/13] sched: Add task_struct pointer to sched_class::set_curr_task Peter Zijlstra
2019-07-26 14:54 ` [RFC][PATCH 06/13] sched/fair: Export newidle_balance() Peter Zijlstra
2019-07-26 14:54 ` [RFC][PATCH 07/13] sched: Allow put_prev_task() to drop rq->lock Peter Zijlstra
2019-07-26 14:54 ` [RFC][PATCH 08/13] sched: Rework pick_next_task() slow-path Peter Zijlstra
2019-07-26 14:54 ` [RFC][PATCH 09/13] sched: Unify runtime accounting across classes Peter Zijlstra
2019-07-26 14:54 ` [RFC][PATCH 10/13] sched/deadline: Collect sched_dl_entity initialization Peter Zijlstra
2019-07-26 14:54 ` [RFC][PATCH 11/13] sched/deadline: Move bandwidth accounting into {en,de}queue_dl_entity Peter Zijlstra
2019-07-26 14:54 ` [RFC][PATCH 12/13] sched/deadline: Introduce deadline servers Peter Zijlstra
2019-08-07 16:31 ` Dietmar Eggemann
2019-08-08 6:52 ` Juri Lelli
2019-08-08 7:52 ` Dietmar Eggemann
2019-08-08 7:56 ` Peter Zijlstra
2019-08-08 8:11 ` Dietmar Eggemann
2019-08-08 8:46 ` Juri Lelli
2019-08-08 8:57 ` Dietmar Eggemann
2019-08-08 9:27 ` Juri Lelli
2019-08-08 9:45 ` Juri Lelli
2019-08-30 11:24 ` Peter Zijlstra
2019-09-06 9:36 ` Juri Lelli
2019-08-08 10:31 ` Peter Zijlstra
2019-08-09 7:13 ` Juri Lelli
2019-08-08 6:59 ` Juri Lelli
2019-08-09 9:17 ` Dietmar Eggemann
2019-08-09 12:16 ` Juri Lelli
2019-07-26 14:54 ` [RFC][PATCH 13/13] sched/fair: Add trivial fair server Peter Zijlstra
2019-07-26 20:01 ` [RFC][PATCH 00/13] SCHED_DEADLINE server infrastructure luca abeni
2019-09-03 14:27 ` Alessio Balsini
2019-09-04 10:50 ` Juri Lelli
2019-09-04 11:32 ` Peter Zijlstra
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190822165125.GW2369@hirez.programming.kicks-ass.net \
--to=peterz@infradead.org \
--cc=balsini@android.com \
--cc=bristot@redhat.com \
--cc=dietmar.eggemann@arm.com \
--cc=dvyukov@google.com \
--cc=juri.lelli@redhat.com \
--cc=kernel-team@android.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luca.abeni@santannapisa.it \
--cc=mingo@kernel.org \
--cc=rostedt@goodmis.org \
--cc=tglx@linutronix.de \
--cc=vpillai@digitalocean.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).