Kirill Tkhai
2019-Jan-10 09:22 UTC
[Bridge] [PATCH v2] netfilter: account ebt_table_info to kmemcg
On 06.01.2019 14:00, Kirill Tkhai wrote:> On 03.01.2019 06:14, Shakeel Butt wrote: >> The [ip,ip6,arp]_tables use x_tables_info internally and the underlying >> memory is already accounted to kmemcg. Do the same for ebtables. The >> syzbot, by using setsockopt(EBT_SO_SET_ENTRIES), was able to OOM the >> whole system from a restricted memcg, a potential DoS. >> >> By accounting the ebt_table_info, the memory used for ebt_table_info can >> be contained within the memcg of the allocating process. However the >> lifetime of ebt_table_info is independent of the allocating process and >> is tied to the network namespace. So, the oom-killer will not be able to >> relieve the memory pressure due to ebt_table_info memory. The memory for >> ebt_table_info is allocated through vmalloc. Currently vmalloc does not >> handle the oom-killed allocating process correctly and one large >> allocation can bypass memcg limit enforcement. So, with this patch, >> at least the small allocations will be contained. For large allocations, >> we need to fix vmalloc. >> >> Reported-by: syzbot+7713f3aa67be76b1552c at syzkaller.appspotmail.com >> Signed-off-by: Shakeel Butt <shakeelb at google.com> >> Cc: Florian Westphal <fw at strlen.de> >> Cc: Michal Hocko <mhocko at kernel.org> >> Cc: Kirill Tkhai <ktkhai at virtuozzo.com> >> Cc: Pablo Neira Ayuso <pablo at netfilter.org> >> Cc: Jozsef Kadlecsik <kadlec at blackhole.kfki.hu> >> Cc: Roopa Prabhu <roopa at cumulusnetworks.com> >> Cc: Nikolay Aleksandrov <nikolay at cumulusnetworks.com> >> Cc: Andrew Morton <akpm at linux-foundation.org> >> Cc: Linux MM <linux-mm at kvack.org> >> Cc: netfilter-devel at vger.kernel.org >> Cc: coreteam at netfilter.org >> Cc: bridge at lists.linux-foundation.org >> Cc: LKML <linux-kernel at vger.kernel.org> >> --- >> Changelog since v1: >> - More descriptive commit message. > > Reviewed-by: Kirill Tkhai <ktkhai at virtuozzo.com> > >> >> net/bridge/netfilter/ebtables.c | 6 ++++-- >> 1 file changed, 4 insertions(+), 2 deletions(-) >> >> diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c >> index 491828713e0b..5e55cef0cec3 100644 >> --- a/net/bridge/netfilter/ebtables.c >> +++ b/net/bridge/netfilter/ebtables.c >> @@ -1137,14 +1137,16 @@ static int do_replace(struct net *net, const void __user *user, >> tmp.name[sizeof(tmp.name) - 1] = 0; >> >> countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids; >> - newinfo = vmalloc(sizeof(*newinfo) + countersize); >> + newinfo = __vmalloc(sizeof(*newinfo) + countersize, GFP_KERNEL_ACCOUNT, >> + PAGE_KERNEL);Do we need GFP_HIGHMEM here?>> if (!newinfo) >> return -ENOMEM; >> >> if (countersize) >> memset(newinfo->counters, 0, countersize); >> >> - newinfo->entries = vmalloc(tmp.entries_size); >> + newinfo->entries = __vmalloc(tmp.entries_size, GFP_KERNEL_ACCOUNT, >> + PAGE_KERNEL); >> if (!newinfo->entries) { >> ret = -ENOMEM; >> goto free_newinfo; >> >
Michal Hocko
2019-Jan-10 09:41 UTC
[Bridge] [PATCH v2] netfilter: account ebt_table_info to kmemcg
On Thu 10-01-19 12:22:09, Kirill Tkhai wrote: [...]> >> diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c > >> index 491828713e0b..5e55cef0cec3 100644 > >> --- a/net/bridge/netfilter/ebtables.c > >> +++ b/net/bridge/netfilter/ebtables.c > >> @@ -1137,14 +1137,16 @@ static int do_replace(struct net *net, const void __user *user, > >> tmp.name[sizeof(tmp.name) - 1] = 0; > >> > >> countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids; > >> - newinfo = vmalloc(sizeof(*newinfo) + countersize); > >> + newinfo = __vmalloc(sizeof(*newinfo) + countersize, GFP_KERNEL_ACCOUNT, > >> + PAGE_KERNEL); > > Do we need GFP_HIGHMEM here?No. vmalloc adds __GPF_HIGHMEM implicitly (see __vmalloc_area_node). -- Michal Hocko SUSE Labs