From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.2 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BDB80C07E9D for ; Mon, 19 Jul 2021 10:46:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A1FB561006 for ; Mon, 19 Jul 2021 10:46:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236438AbhGSKF3 (ORCPT ); Mon, 19 Jul 2021 06:05:29 -0400 Received: from relay.sw.ru ([185.231.240.75]:44884 "EHLO relay.sw.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236557AbhGSKFG (ORCPT ); Mon, 19 Jul 2021 06:05:06 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Content-Type:MIME-Version:Date:Message-ID:Subject :From; bh=97E+pWsg1fRqSD4/pNq55qMVP3zQsBJJmg0TKYUHtmA=; b=bnoy8snEG7YOPop/cLE SrCz+IbDfRt+DLvfyz7GmopfWE/LrVQkLivZnhkP95Xtv8pqb/21NR9hTAvAO6/7dJcYolEFF8sie PAdNZRg0HRjv90KRRiZAPD+/Dea0VaGeaqXcqSM2mZ9lBFWNhyZiLwNOItaKjBTRLgQ+X6FLnXs=; Received: from [10.93.0.56] by relay.sw.ru with esmtp (Exim 4.94.2) (envelope-from ) id 1m5QmP-004RiA-LA; Mon, 19 Jul 2021 13:45:45 +0300 From: Vasily Averin Subject: [PATCH v5 13/16] memcg: enable accounting for signals To: Andrew Morton Cc: cgroups@vger.kernel.org, Michal Hocko , Shakeel Butt , Johannes Weiner , Vladimir Davydov , Roman Gushchin , Jens Axboe , "Eric W. Biederman" , Oleg Nesterov , linux-kernel@vger.kernel.org References: Message-ID: Date: Mon, 19 Jul 2021 13:45:44 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.11.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When a user send a signal to any another processes it forces the kernel to allocate memory for 'struct sigqueue' objects. The number of signals is limited by RLIMIT_SIGPENDING resource limit, but even the default settings allow each user to consume up to several megabytes of memory. Moreover, an untrusted admin inside container can increase the limit or create new fake users and force them to sent signals. It makes sense to account for these allocations to restrict the host's memory consumption from inside the memcg-limited container. Signed-off-by: Vasily Averin --- kernel/signal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/signal.c b/kernel/signal.c index a3229ad..8921c4a 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -4663,7 +4663,7 @@ void __init signals_init(void) { siginfo_buildtime_checks(); - sigqueue_cachep = KMEM_CACHE(sigqueue, SLAB_PANIC); + sigqueue_cachep = KMEM_CACHE(sigqueue, SLAB_PANIC | SLAB_ACCOUNT); } #ifdef CONFIG_KGDB_KDB -- 1.8.3.1