linux-kernel - Re: [PATCH v2] pipe: limit the per-user amount of pages allocated in pipes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 11 Jan 2016 13:37:47 +0100
From:	Willy Tarreau <w@....eu>
To:	Alexander Viro <viro@...iv.linux.org.uk>
Cc:	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	socketpair@...il.com,
	Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
Subject: Re: [PATCH v2] pipe: limit the per-user amount of pages allocated in pipes

On Mon, Jan 11, 2016 at 12:26:20PM +0000, Willy Tarreau wrote:
> This patch makes it possible to enforce a per-user limit above which
> new pipes will be limited to a single page, effectively limiting them
> to 4 kB each. This has the effect of protecting the system against
> memory abuse without hurting other users, and still allowing pipes to
> work correctly though with less data at once.
> 
> The limit is controlled by the new sysctl user-max-pipe-pages, and may
> be disabled by setting it to zero. The default limit allows the default
> number of FDs per process (1024) to create pipes of the default size
> (64kB), thus reaching a limit of 64MB before starting to create only
> smaller pipes. With 256 processes limited to 1024 FDs each, this results
> in 1024*64kB + (256*1024 - 1024) * 4kB = 1084 MB of memory allocated for
> a user.

Regarding this, I was wondering if we shouldn't go a bit further and provide
two limits instead of one : a soft and a hard limit. The soft limit would be
the number of pages per user above which pipes are limited to a single page
(what is implemented in the current patch). The hard limit would make any
pipe creation attempt fail once reached. This way it would be possible to
enforce a strict limit without limiting the number of processes or FDs too
aggressively.

This could be done easily in alloc_pipe_info() :

+               if (too_many_pipe_buffers_hard(user))
+                       return NULL;
+
                if (too_many_pipe_buffers(user))
                        pipe_bufs = 1;

I'm just having a hard time imagining acceptable names for the syscalls :-/

Willy