| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAAVpQUAkhJ8L_z7Y3T9HkZ-rcgsZE2Sbk0QEh4EUCf_mcAV19Q@mail.gmail.com>
Date: Fri, 19 Sep 2025 23:22:21 -0700
From: Kuniyuki Iwashima <kuniyu@...gle.com>
To: Shakeel Butt <shakeel.butt@...ux.dev>
Cc: Alexei Starovoitov <ast@...nel.org>, Andrii Nakryiko <andrii@...nel.org>,
Daniel Borkmann <daniel@...earbox.net>, Martin KaFai Lau <martin.lau@...ux.dev>,
John Fastabend <john.fastabend@...il.com>, Stanislav Fomichev <sdf@...ichev.me>,
Johannes Weiner <hannes@...xchg.org>, Michal Hocko <mhocko@...nel.org>,
Roman Gushchin <roman.gushchin@...ux.dev>, "David S. Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
Neal Cardwell <ncardwell@...gle.com>, Willem de Bruijn <willemb@...gle.com>,
Mina Almasry <almasrymina@...gle.com>, Kuniyuki Iwashima <kuni1840@...il.com>, bpf@...r.kernel.org,
netdev@...r.kernel.org
Subject: Re: [PATCH v10 bpf-next/net 3/6] net-memcg: Introduce
net.core.memcg_exclusive sysctl.
On Fri, Sep 19, 2025 at 10:36 PM Shakeel Butt <shakeel.butt@...ux.dev> wrote:
>
> On Sat, Sep 20, 2025 at 12:07:17AM +0000, Kuniyuki Iwashima wrote:
> > If net.core.memcg_exclusive is 1 when sk->sk_memcg is allocated,
> > the socket is flagged with SK_MEMCG_EXCLUSIVE internally and skips
> > the global per-protocol memory accounting.
> >
> > OTOH, for accept()ed child sockets, this flag is inherited from
> > the listening socket in sk_clone_lock() and set in __inet_accept().
> > This is to preserve the decision by BPF which will be supported later.
> >
> > Given sk->sk_memcg can be accessed in the fast path, it would
> > be preferable to place the flag field in the same cache line as
> > sk->sk_memcg.
> >
> > However, struct sock does not have such a 1-byte hole.
> >
> > Let's store the flag in the lowest bit of sk->sk_memcg and check
> > it in mem_cgroup_sk_exclusive().
> >
> > Tested with a script that creates local socket pairs and send()s a
> > bunch of data without recv()ing.
> >
> > Setup:
> >
> > # mkdir /sys/fs/cgroup/test
> > # echo $$ >> /sys/fs/cgroup/test/cgroup.procs
> > # sysctl -q net.ipv4.tcp_mem="1000 1000 1000"
> >
> > Without net.core.memcg_exclusive, charged to memcg & tcp_mem:
> >
> > # prlimit -n=524288:524288 bash -c "python3 pressure.py" &
> > # cat /sys/fs/cgroup/test/memory.stat | grep sock
> > sock 22642688 <-------------------------------------- charged to memcg
> > # cat /proc/net/sockstat| grep TCP
> > TCP: inuse 2006 orphan 0 tw 0 alloc 2008 mem 5376 <-- charged to tcp_mem
> > # ss -tn | head -n 5
> > State Recv-Q Send-Q Local Address:Port Peer Address:Port
> > ESTAB 2000 0 127.0.0.1:34479 127.0.0.1:53188
> > ESTAB 2000 0 127.0.0.1:34479 127.0.0.1:49972
> > ESTAB 2000 0 127.0.0.1:34479 127.0.0.1:53868
> > ESTAB 2000 0 127.0.0.1:34479 127.0.0.1:53554
> > # nstat | grep Pressure || echo no pressure
> > TcpExtTCPMemoryPressures 1 0.0
> >
> > With net.core.memcg_exclusive=1, only charged to memcg:
> >
> > # sysctl -q net.core.memcg_exclusive=1
> > # prlimit -n=524288:524288 bash -c "python3 pressure.py" &
> > # cat /sys/fs/cgroup/test/memory.stat | grep sock
> > sock 2757468160 <------------------------------------ charged to memcg
> > # cat /proc/net/sockstat | grep TCP
> > TCP: inuse 2006 orphan 0 tw 0 alloc 2008 mem 0 <- NOT charged to tcp_mem
> > # ss -tn | head -n 5
> > State Recv-Q Send-Q Local Address:Port Peer Address:Port
> > ESTAB 111000 0 127.0.0.1:36019 127.0.0.1:49026
> > ESTAB 110000 0 127.0.0.1:36019 127.0.0.1:45630
> > ESTAB 110000 0 127.0.0.1:36019 127.0.0.1:44870
> > ESTAB 111000 0 127.0.0.1:36019 127.0.0.1:45274
> > # nstat | grep Pressure || echo no pressure
> > no pressure
> >
> > Signed-off-by: Kuniyuki Iwashima <kuniyu@...gle.com>
> > ---
> > v8: Fix build failure when CONFIG_NET=n
> > ---
> > Documentation/admin-guide/sysctl/net.rst | 9 ++++++
> > include/net/netns/core.h | 3 ++
> > include/net/sock.h | 39 ++++++++++++++++++++++--
> > mm/memcontrol.c | 12 +++++++-
> > net/core/sock.c | 1 +
> > net/core/sysctl_net_core.c | 11 +++++++
> > net/ipv4/af_inet.c | 4 +++
> > 7 files changed, 76 insertions(+), 3 deletions(-)
> >
> > diff --git a/Documentation/admin-guide/sysctl/net.rst b/Documentation/admin-guide/sysctl/net.rst
> > index 2ef50828aff1..7272194dcf45 100644
> > --- a/Documentation/admin-guide/sysctl/net.rst
> > +++ b/Documentation/admin-guide/sysctl/net.rst
> > @@ -212,6 +212,15 @@ mem_pcpu_rsv
> >
> > Per-cpu reserved forward alloc cache size in page units. Default 1MB per CPU.
> >
> > +memcg_exclusive
> > +---------------
> > +
> > +Skip charging socket buffers to the per-protocol global memory accounting
> > +(controlled by net.ipv4.tcp_mem, etc) if they are already charged to the
> > +cgroup memory controller ("sock" in memory.stat file).
> > +
> > +Default: 0
> > +
> > rmem_default
> > ------------
> >
> > diff --git a/include/net/netns/core.h b/include/net/netns/core.h
> > index 9b36f0ff0c20..ec511088e67d 100644
> > --- a/include/net/netns/core.h
> > +++ b/include/net/netns/core.h
> > @@ -16,6 +16,9 @@ struct netns_core {
> > int sysctl_optmem_max;
> > u8 sysctl_txrehash;
> > u8 sysctl_tstamp_allow_data;
> > +#ifdef CONFIG_MEMCG
> > + u8 sysctl_memcg_exclusive;
> > +#endif
>
> Hmm will this be a system level or namespace level sysctl? Seems like ns
> level, any reason to go with netns level?
This is netns-level, I don't have a specific reason other than
granularity and have no preference. Anyway, either
system-level or netns-level require admin privilege.
Powered by blists - more mailing lists