Commit | Line | Data |
---|---|---|
49b786ea AS |
1 | /* |
2 | * Process number limiting controller for cgroups. | |
3 | * | |
4 | * Used to allow a cgroup hierarchy to stop any new processes from fork()ing | |
5 | * after a certain limit is reached. | |
6 | * | |
7 | * Since it is trivial to hit the task limit without hitting any kmemcg limits | |
8 | * in place, PIDs are a fundamental resource. As such, PID exhaustion must be | |
9 | * preventable in the scope of a cgroup hierarchy by allowing resource limiting | |
10 | * of the number of tasks in a cgroup. | |
11 | * | |
12 | * In order to use the `pids` controller, set the maximum number of tasks in | |
13 | * pids.max (this is not available in the root cgroup for obvious reasons). The | |
14 | * number of processes currently in the cgroup is given by pids.current. | |
15 | * Organisational operations are not blocked by cgroup policies, so it is | |
16 | * possible to have pids.current > pids.max. However, it is not possible to | |
17 | * violate a cgroup policy through fork(). fork() will return -EAGAIN if forking | |
18 | * would cause a cgroup policy to be violated. | |
19 | * | |
20 | * To set a cgroup to have no limit, set pids.max to "max". This is the default | |
21 | * for all new cgroups (N.B. that PID limits are hierarchical, so the most | |
22 | * stringent limit in the hierarchy is followed). | |
23 | * | |
24 | * pids.current tracks all child cgroup hierarchies, so parent/pids.current is | |
25 | * a superset of parent/child/pids.current. | |
26 | * | |
27 | * Copyright (C) 2015 Aleksa Sarai <cyphar@cyphar.com> | |
28 | * | |
29 | * This file is subject to the terms and conditions of version 2 of the GNU | |
30 | * General Public License. See the file COPYING in the main directory of the | |
31 | * Linux distribution for more details. | |
32 | */ | |
33 | ||
34 | #include <linux/kernel.h> | |
35 | #include <linux/threads.h> | |
36 | #include <linux/atomic.h> | |
37 | #include <linux/cgroup.h> | |
38 | #include <linux/slab.h> | |
39 | ||
40 | #define PIDS_MAX (PID_MAX_LIMIT + 1ULL) | |
41 | #define PIDS_MAX_STR "max" | |
42 | ||
43 | struct pids_cgroup { | |
44 | struct cgroup_subsys_state css; | |
45 | ||
46 | /* | |
47 | * Use 64-bit types so that we can safely represent "max" as | |
48 | * %PIDS_MAX = (%PID_MAX_LIMIT + 1). | |
49 | */ | |
50 | atomic64_t counter; | |
51 | int64_t limit; | |
135b8b37 KY |
52 | |
53 | /* Handle for "pids.events" */ | |
54 | struct cgroup_file events_file; | |
55 | ||
56 | /* Number of times fork failed because limit was hit. */ | |
57 | atomic64_t events_limit; | |
49b786ea AS |
58 | }; |
59 | ||
60 | static struct pids_cgroup *css_pids(struct cgroup_subsys_state *css) | |
61 | { | |
62 | return container_of(css, struct pids_cgroup, css); | |
63 | } | |
64 | ||
65 | static struct pids_cgroup *parent_pids(struct pids_cgroup *pids) | |
66 | { | |
67 | return css_pids(pids->css.parent); | |
68 | } | |
69 | ||
70 | static struct cgroup_subsys_state * | |
71 | pids_css_alloc(struct cgroup_subsys_state *parent) | |
72 | { | |
73 | struct pids_cgroup *pids; | |
74 | ||
75 | pids = kzalloc(sizeof(struct pids_cgroup), GFP_KERNEL); | |
76 | if (!pids) | |
77 | return ERR_PTR(-ENOMEM); | |
78 | ||
79 | pids->limit = PIDS_MAX; | |
80 | atomic64_set(&pids->counter, 0); | |
135b8b37 | 81 | atomic64_set(&pids->events_limit, 0); |
49b786ea AS |
82 | return &pids->css; |
83 | } | |
84 | ||
85 | static void pids_css_free(struct cgroup_subsys_state *css) | |
86 | { | |
87 | kfree(css_pids(css)); | |
88 | } | |
89 | ||
90 | /** | |
91 | * pids_cancel - uncharge the local pid count | |
92 | * @pids: the pid cgroup state | |
93 | * @num: the number of pids to cancel | |
94 | * | |
95 | * This function will WARN if the pid count goes under 0, because such a case is | |
96 | * a bug in the pids controller proper. | |
97 | */ | |
98 | static void pids_cancel(struct pids_cgroup *pids, int num) | |
99 | { | |
100 | /* | |
101 | * A negative count (or overflow for that matter) is invalid, | |
102 | * and indicates a bug in the `pids` controller proper. | |
103 | */ | |
104 | WARN_ON_ONCE(atomic64_add_negative(-num, &pids->counter)); | |
105 | } | |
106 | ||
107 | /** | |
108 | * pids_uncharge - hierarchically uncharge the pid count | |
109 | * @pids: the pid cgroup state | |
110 | * @num: the number of pids to uncharge | |
111 | */ | |
112 | static void pids_uncharge(struct pids_cgroup *pids, int num) | |
113 | { | |
114 | struct pids_cgroup *p; | |
115 | ||
67cde9c4 | 116 | for (p = pids; parent_pids(p); p = parent_pids(p)) |
49b786ea AS |
117 | pids_cancel(p, num); |
118 | } | |
119 | ||
120 | /** | |
121 | * pids_charge - hierarchically charge the pid count | |
122 | * @pids: the pid cgroup state | |
123 | * @num: the number of pids to charge | |
124 | * | |
125 | * This function does *not* follow the pid limit set. It cannot fail and the new | |
126 | * pid count may exceed the limit. This is only used for reverting failed | |
127 | * attaches, where there is no other way out than violating the limit. | |
128 | */ | |
129 | static void pids_charge(struct pids_cgroup *pids, int num) | |
130 | { | |
131 | struct pids_cgroup *p; | |
132 | ||
67cde9c4 | 133 | for (p = pids; parent_pids(p); p = parent_pids(p)) |
49b786ea AS |
134 | atomic64_add(num, &p->counter); |
135 | } | |
136 | ||
137 | /** | |
138 | * pids_try_charge - hierarchically try to charge the pid count | |
139 | * @pids: the pid cgroup state | |
140 | * @num: the number of pids to charge | |
141 | * | |
142 | * This function follows the set limit. It will fail if the charge would cause | |
143 | * the new value to exceed the hierarchical limit. Returns 0 if the charge | |
fccd3af5 | 144 | * succeeded, otherwise -EAGAIN. |
49b786ea AS |
145 | */ |
146 | static int pids_try_charge(struct pids_cgroup *pids, int num) | |
147 | { | |
148 | struct pids_cgroup *p, *q; | |
149 | ||
67cde9c4 | 150 | for (p = pids; parent_pids(p); p = parent_pids(p)) { |
49b786ea AS |
151 | int64_t new = atomic64_add_return(num, &p->counter); |
152 | ||
153 | /* | |
154 | * Since new is capped to the maximum number of pid_t, if | |
155 | * p->limit is %PIDS_MAX then we know that this test will never | |
156 | * fail. | |
157 | */ | |
158 | if (new > p->limit) | |
159 | goto revert; | |
160 | } | |
161 | ||
162 | return 0; | |
163 | ||
164 | revert: | |
165 | for (q = pids; q != p; q = parent_pids(q)) | |
166 | pids_cancel(q, num); | |
167 | pids_cancel(p, num); | |
168 | ||
169 | return -EAGAIN; | |
170 | } | |
171 | ||
1f7dd3e5 | 172 | static int pids_can_attach(struct cgroup_taskset *tset) |
49b786ea | 173 | { |
49b786ea | 174 | struct task_struct *task; |
1f7dd3e5 | 175 | struct cgroup_subsys_state *dst_css; |
49b786ea | 176 | |
1f7dd3e5 TH |
177 | cgroup_taskset_for_each(task, dst_css, tset) { |
178 | struct pids_cgroup *pids = css_pids(dst_css); | |
49b786ea AS |
179 | struct cgroup_subsys_state *old_css; |
180 | struct pids_cgroup *old_pids; | |
181 | ||
182 | /* | |
ce523995 AS |
183 | * No need to pin @old_css between here and cancel_attach() |
184 | * because cgroup core protects it from being freed before | |
185 | * the migration completes or fails. | |
49b786ea | 186 | */ |
ce523995 | 187 | old_css = task_css(task, pids_cgrp_id); |
49b786ea AS |
188 | old_pids = css_pids(old_css); |
189 | ||
190 | pids_charge(pids, 1); | |
191 | pids_uncharge(old_pids, 1); | |
192 | } | |
193 | ||
194 | return 0; | |
195 | } | |
196 | ||
1f7dd3e5 | 197 | static void pids_cancel_attach(struct cgroup_taskset *tset) |
49b786ea | 198 | { |
49b786ea | 199 | struct task_struct *task; |
1f7dd3e5 | 200 | struct cgroup_subsys_state *dst_css; |
49b786ea | 201 | |
1f7dd3e5 TH |
202 | cgroup_taskset_for_each(task, dst_css, tset) { |
203 | struct pids_cgroup *pids = css_pids(dst_css); | |
49b786ea AS |
204 | struct cgroup_subsys_state *old_css; |
205 | struct pids_cgroup *old_pids; | |
206 | ||
207 | old_css = task_css(task, pids_cgrp_id); | |
208 | old_pids = css_pids(old_css); | |
209 | ||
210 | pids_charge(old_pids, 1); | |
211 | pids_uncharge(pids, 1); | |
49b786ea AS |
212 | } |
213 | } | |
214 | ||
afbcb364 ON |
215 | /* |
216 | * task_css_check(true) in pids_can_fork() and pids_cancel_fork() relies | |
217 | * on threadgroup_change_begin() held by the copy_process(). | |
218 | */ | |
b53202e6 | 219 | static int pids_can_fork(struct task_struct *task) |
49b786ea AS |
220 | { |
221 | struct cgroup_subsys_state *css; | |
222 | struct pids_cgroup *pids; | |
135b8b37 | 223 | int err; |
49b786ea | 224 | |
afbcb364 | 225 | css = task_css_check(current, pids_cgrp_id, true); |
49b786ea | 226 | pids = css_pids(css); |
135b8b37 KY |
227 | err = pids_try_charge(pids, 1); |
228 | if (err) { | |
229 | /* Only log the first time events_limit is incremented. */ | |
230 | if (atomic64_inc_return(&pids->events_limit) == 1) { | |
231 | pr_info("cgroup: fork rejected by pids controller in "); | |
232 | pr_cont_cgroup_path(task_cgroup(current, pids_cgrp_id)); | |
233 | pr_cont("\n"); | |
234 | } | |
235 | cgroup_file_notify(&pids->events_file); | |
236 | } | |
237 | return err; | |
49b786ea AS |
238 | } |
239 | ||
b53202e6 | 240 | static void pids_cancel_fork(struct task_struct *task) |
49b786ea | 241 | { |
afbcb364 ON |
242 | struct cgroup_subsys_state *css; |
243 | struct pids_cgroup *pids; | |
49b786ea | 244 | |
afbcb364 ON |
245 | css = task_css_check(current, pids_cgrp_id, true); |
246 | pids = css_pids(css); | |
49b786ea | 247 | pids_uncharge(pids, 1); |
49b786ea AS |
248 | } |
249 | ||
afcf6c8b | 250 | static void pids_free(struct task_struct *task) |
49b786ea | 251 | { |
2e91fa7f | 252 | struct pids_cgroup *pids = css_pids(task_css(task, pids_cgrp_id)); |
49b786ea AS |
253 | |
254 | pids_uncharge(pids, 1); | |
255 | } | |
256 | ||
257 | static ssize_t pids_max_write(struct kernfs_open_file *of, char *buf, | |
258 | size_t nbytes, loff_t off) | |
259 | { | |
260 | struct cgroup_subsys_state *css = of_css(of); | |
261 | struct pids_cgroup *pids = css_pids(css); | |
262 | int64_t limit; | |
263 | int err; | |
264 | ||
265 | buf = strstrip(buf); | |
266 | if (!strcmp(buf, PIDS_MAX_STR)) { | |
267 | limit = PIDS_MAX; | |
268 | goto set_limit; | |
269 | } | |
270 | ||
271 | err = kstrtoll(buf, 0, &limit); | |
272 | if (err) | |
273 | return err; | |
274 | ||
275 | if (limit < 0 || limit >= PIDS_MAX) | |
276 | return -EINVAL; | |
277 | ||
278 | set_limit: | |
279 | /* | |
280 | * Limit updates don't need to be mutex'd, since it isn't | |
281 | * critical that any racing fork()s follow the new limit. | |
282 | */ | |
283 | pids->limit = limit; | |
284 | return nbytes; | |
285 | } | |
286 | ||
287 | static int pids_max_show(struct seq_file *sf, void *v) | |
288 | { | |
289 | struct cgroup_subsys_state *css = seq_css(sf); | |
290 | struct pids_cgroup *pids = css_pids(css); | |
291 | int64_t limit = pids->limit; | |
292 | ||
293 | if (limit >= PIDS_MAX) | |
294 | seq_printf(sf, "%s\n", PIDS_MAX_STR); | |
295 | else | |
296 | seq_printf(sf, "%lld\n", limit); | |
297 | ||
298 | return 0; | |
299 | } | |
300 | ||
301 | static s64 pids_current_read(struct cgroup_subsys_state *css, | |
302 | struct cftype *cft) | |
303 | { | |
304 | struct pids_cgroup *pids = css_pids(css); | |
305 | ||
306 | return atomic64_read(&pids->counter); | |
307 | } | |
308 | ||
135b8b37 KY |
309 | static int pids_events_show(struct seq_file *sf, void *v) |
310 | { | |
311 | struct pids_cgroup *pids = css_pids(seq_css(sf)); | |
312 | ||
9f6870dd | 313 | seq_printf(sf, "max %lld\n", (s64)atomic64_read(&pids->events_limit)); |
135b8b37 KY |
314 | return 0; |
315 | } | |
316 | ||
49b786ea AS |
317 | static struct cftype pids_files[] = { |
318 | { | |
319 | .name = "max", | |
320 | .write = pids_max_write, | |
321 | .seq_show = pids_max_show, | |
322 | .flags = CFTYPE_NOT_ON_ROOT, | |
323 | }, | |
324 | { | |
325 | .name = "current", | |
326 | .read_s64 = pids_current_read, | |
67cde9c4 | 327 | .flags = CFTYPE_NOT_ON_ROOT, |
49b786ea | 328 | }, |
135b8b37 KY |
329 | { |
330 | .name = "events", | |
331 | .seq_show = pids_events_show, | |
332 | .file_offset = offsetof(struct pids_cgroup, events_file), | |
333 | .flags = CFTYPE_NOT_ON_ROOT, | |
334 | }, | |
49b786ea AS |
335 | { } /* terminate */ |
336 | }; | |
337 | ||
338 | struct cgroup_subsys pids_cgrp_subsys = { | |
339 | .css_alloc = pids_css_alloc, | |
340 | .css_free = pids_css_free, | |
49b786ea AS |
341 | .can_attach = pids_can_attach, |
342 | .cancel_attach = pids_cancel_attach, | |
343 | .can_fork = pids_can_fork, | |
344 | .cancel_fork = pids_cancel_fork, | |
afcf6c8b | 345 | .free = pids_free, |
49b786ea AS |
346 | .legacy_cftypes = pids_files, |
347 | .dfl_cftypes = pids_files, | |
348 | }; |