lkml.org 
[lkml]   [2015]   [Nov]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v2 6/6] Account certain kmem allocations to memcg
On Tue, Nov 10, 2015 at 09:34:07PM +0300, Vladimir Davydov wrote:
> This patch marks those kmem allocations that are known to be easily
> triggered from userspace as __GFP_ACCOUNT/SLAB_ACCOUNT, which makes them
> accounted to memcg. For the list, see below:
>
> - threadinfo
> - task_struct
> - task_delay_info
> - pid
> - cred
> - mm_struct
> - vm_area_struct and vm_region (nommu)
> - anon_vma and anon_vma_chain
> - signal_struct
> - sighand_struct
> - fs_struct
> - files_struct
> - fdtable and fdtable->full_fds_bits
> - dentry and external_name
> - inode for all filesystems. This is the most tedious part, because
> most filesystems overwrite the alloc_inode method.
>
> The list is by far not complete, so feel free to add more objects.
> Nevertheless, it should be close to "account everything" approach and
> keep most workloads within bounds. Malevolent users will be able to
> breach the limit, but this was possible even with the former "account
> everything" approach (simply because it did not account everything in
> fact).
>
> Signed-off-by: Vladimir Davydov <vdavydov@virtuozzo.com>

Thanks for doing that work, Vladimir. It looks reasonable to me.

We can update the list as we go along and testing reveals more things
that need to be considered. As far as malicious users go, I agree that
we can not make this bullet proof, and so we shouldn't aim for that.

Acked-by: Johannes Weiner <hannes@cmpxchg.org>


\
 
 \ /
  Last update: 2015-11-19 20:41    [W:0.134 / U:1.680 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site