linux.git/ipc/namespace.c, branch v6.6.132

ipc: fix memleak if msg_init_ns failed in create_ipc_ns

2024-12-09T09:32:54+00:00

commit bc8f5921cd69188627c08041276238de222ab466 upstream.

Percpu memory allocation may failed during create_ipc_ns however this
fail is not handled properly since ipc sysctls and mq sysctls is not
released properly. Fix this by release these two resource when failure.

Here is the kmemleak stack when percpu failed:

unreferenced object 0xffff88819de2a600 (size 512):
  comm "shmem_2nstest", pid 120711, jiffies 4300542254
  hex dump (first 32 bytes):
    60 aa 9d 84 ff ff ff ff fc 18 48 b2 84 88 ff ff  `.........H.....
    04 00 00 00 a4 01 00 00 20 e4 56 81 ff ff ff ff  ........ .V.....
  backtrace (crc be7cba35):
    [] __kmalloc_node_track_caller_noprof+0x333/0x420
    [] kmemdup_noprof+0x26/0x50
    [] setup_mq_sysctls+0x57/0x1d0
    [] copy_ipcs+0x29c/0x3b0
    [] create_new_namespaces+0x1d0/0x920
    [] copy_namespaces+0x2e9/0x3e0
    [] copy_process+0x29f3/0x7ff0
    [] kernel_clone+0xc0/0x650
    [] __do_sys_clone+0xa1/0xe0
    [] do_syscall_64+0xbf/0x1c0
    [] entry_SYSCALL_64_after_hwframe+0x4b/0x53

Link: https://lkml.kernel.org/r/20241023093129.3074301-1-mawupeng1@huawei.com
Fixes: 72d1e611082e ("ipc/msg: mitigate the lock contention with percpu counter")
Signed-off-by: Ma Wupeng 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

ipc,namespace: batch free ipc_namespace structures

2023-01-28T00:08:00+00:00

Instead of waiting for an RCU grace period between each ipc_namespace
structure that is being freed, wait an RCU grace period for every batch
of ipc_namespace structures.

Thanks to Al Viro for the suggestion of the helper function.

This speeds up the run time of the test case that allocates ipc_namespaces
in a loop from 6 minutes, to a little over 1 second:

real	0m1.192s
user	0m0.038s
sys	0m1.152s

Signed-off-by: Rik van Riel 
Reported-by: Chris Mason 
Tested-by: Giuseppe Scrivano 
Suggested-by: Al Viro 
Signed-off-by: Al Viro

ipc,namespace: make ipc namespace allocation wait for pending free

2023-01-28T00:07:59+00:00

Currently the ipc namespace allocation will fail when there are
ipc_namespace structures pending to be freed. This results in the
simple test case below, as well as some real world workloads, to
get allocation failures even when the number of ipc namespaces in
actual use is way below the limit.

int main()
{
	int i;

	for (i = 0; i < 100000; i++) {
		if (unshare(CLONE_NEWIPC) < 0)
			error(EXIT_FAILURE, errno, "unshare");
	}
}

Make the allocation of an ipc_namespace wait for pending frees,
so it will succeed.

real	6m19.197s
user	0m0.041s
sys	0m1.019s

Signed-off-by: Rik van Riel 
Reported-by: Chris Mason 
Signed-off-by: Al Viro

ipc/msg: mitigate the lock contention with percpu counter

2022-10-03T21:21:44+00:00

The msg_bytes and msg_hdrs atomic counters are frequently updated when IPC
msg queue is in heavy use, causing heavy cache bounce and overhead. 
Change them to percpu_counter greatly improve the performance.  Since
there is one percpu struct per namespace, additional memory cost is
minimal.  Reading of the count done in msgctl call, which is infrequent. 
So the need to sum up the counts in each CPU is infrequent.

Apply the patch and test the pts/stress-ng-1.4.0
-- system v message passing (160 threads).

Score gain: 3.99x

CPU: ICX 8380 x 2 sockets
Core number: 40 x 2 physical cores
Benchmark: pts/stress-ng-1.4.0
-- system v message passing (160 threads)

[akpm@linux-foundation.org: coding-style cleanups]
[jiebin.sun@intel.com: avoid negative value by overflow in msginfo]
  Link: https://lkml.kernel.org/r/20220920150809.4014944-1-jiebin.sun@intel.com
[akpm@linux-foundation.org: fix min() warnings]
Link: https://lkml.kernel.org/r/20220913192538.3023708-3-jiebin.sun@intel.com
Signed-off-by: Jiebin Sun 
Reviewed-by: Tim Chen 
Cc: Alexander Mikhalitsyn 
Cc: Alexey Gladkov 
Cc: Christoph Lameter 
Cc: Davidlohr Bueso 
Cc: Dennis Zhou 
Cc: "Eric W . Biederman" 
Cc: Manfred Spraul 
Cc: Shakeel Butt 
Cc: Tejun Heo 
Cc: Vasily Averin 
Signed-off-by: Andrew Morton

ipc: Free mq_sysctls if ipc namespace creation failed

2022-06-22T22:47:41+00:00

The problem that Dmitry Vyukov pointed out is that if setup_ipc_sysctls fails,
mq_sysctls must be freed before return.

executing program
BUG: memory leak
unreferenced object 0xffff888112fc9200 (size 512):
  comm "syz-executor237", pid 3648, jiffies 4294970469 (age 12.270s)
  hex dump (first 32 bytes):
    ef d3 60 85 ff ff ff ff 0c 9b d2 12 81 88 ff ff  ..`.............
    04 00 00 00 a4 01 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] kmemdup+0x23/0x50 mm/util.c:129
    [] kmemdup include/linux/fortify-string.h:456 [inline]
    [] setup_mq_sysctls+0x4b/0x1c0 ipc/mq_sysctl.c:89
    [] create_ipc_ns ipc/namespace.c:63 [inline]
    [] copy_ipcs+0x292/0x390 ipc/namespace.c:91
    [] create_new_namespaces+0xdc/0x4f0 kernel/nsproxy.c:90
    [] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:226
    [] ksys_unshare+0x2fe/0x600 kernel/fork.c:3165
    [] __do_sys_unshare kernel/fork.c:3236 [inline]
    [] __se_sys_unshare kernel/fork.c:3234 [inline]
    [] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3234
    [] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [] entry_SYSCALL_64_after_hwframe+0x46/0xb0

BUG: memory leak
unreferenced object 0xffff888112fd5f00 (size 256):
  comm "syz-executor237", pid 3648, jiffies 4294970469 (age 12.270s)
  hex dump (first 32 bytes):
    00 92 fc 12 81 88 ff ff 00 00 00 00 01 00 00 00  ................
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] kmalloc include/linux/slab.h:605 [inline]
    [] kzalloc include/linux/slab.h:733 [inline]
    [] __register_sysctl_table+0x7b/0x7f0 fs/proc/proc_sysctl.c:1344
    [] setup_mq_sysctls+0x12a/0x1c0 ipc/mq_sysctl.c:112
    [] create_ipc_ns ipc/namespace.c:63 [inline]
    [] copy_ipcs+0x292/0x390 ipc/namespace.c:91
    [] create_new_namespaces+0xdc/0x4f0 kernel/nsproxy.c:90
    [] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:226
    [] ksys_unshare+0x2fe/0x600 kernel/fork.c:3165
    [] __do_sys_unshare kernel/fork.c:3236 [inline]
    [] __se_sys_unshare kernel/fork.c:3234 [inline]
    [] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3234
    [] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [] entry_SYSCALL_64_after_hwframe+0x46/0xb0

BUG: memory leak
unreferenced object 0xffff888112fbba00 (size 256):
  comm "syz-executor237", pid 3648, jiffies 4294970469 (age 12.270s)
  hex dump (first 32 bytes):
    78 ba fb 12 81 88 ff ff 00 00 00 00 01 00 00 00  x...............
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] kmalloc include/linux/slab.h:605 [inline]
    [] kzalloc include/linux/slab.h:733 [inline]
    [] new_dir fs/proc/proc_sysctl.c:978 [inline]
    [] get_subdir fs/proc/proc_sysctl.c:1022 [inline]
    [] __register_sysctl_table+0x5a9/0x7f0 fs/proc/proc_sysctl.c:1373
    [] setup_mq_sysctls+0x12a/0x1c0 ipc/mq_sysctl.c:112
    [] create_ipc_ns ipc/namespace.c:63 [inline]
    [] copy_ipcs+0x292/0x390 ipc/namespace.c:91
    [] create_new_namespaces+0xdc/0x4f0 kernel/nsproxy.c:90
    [] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:226
    [] ksys_unshare+0x2fe/0x600 kernel/fork.c:3165
    [] __do_sys_unshare kernel/fork.c:3236 [inline]
    [] __se_sys_unshare kernel/fork.c:3234 [inline]
    [] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3234
    [] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [] entry_SYSCALL_64_after_hwframe+0x46/0xb0

BUG: memory leak
unreferenced object 0xffff888112fbb900 (size 256):
  comm "syz-executor237", pid 3648, jiffies 4294970469 (age 12.270s)
  hex dump (first 32 bytes):
    78 b9 fb 12 81 88 ff ff 00 00 00 00 01 00 00 00  x...............
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [] kmalloc include/linux/slab.h:605 [inline]
    [] kzalloc include/linux/slab.h:733 [inline]
    [] new_dir fs/proc/proc_sysctl.c:978 [inline]
    [] get_subdir fs/proc/proc_sysctl.c:1022 [inline]
    [] __register_sysctl_table+0x5a9/0x7f0 fs/proc/proc_sysctl.c:1373
    [] setup_mq_sysctls+0x12a/0x1c0 ipc/mq_sysctl.c:112
    [] create_ipc_ns ipc/namespace.c:63 [inline]
    [] copy_ipcs+0x292/0x390 ipc/namespace.c:91
    [] create_new_namespaces+0xdc/0x4f0 kernel/nsproxy.c:90
    [] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:226
    [] ksys_unshare+0x2fe/0x600 kernel/fork.c:3165
    [] __do_sys_unshare kernel/fork.c:3236 [inline]
    [] __se_sys_unshare kernel/fork.c:3234 [inline]
    [] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3234
    [] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [] entry_SYSCALL_64_after_hwframe+0x46/0xb0

Reported-by: syzbot+b4b0d1b35442afbf6fd2@syzkaller.appspotmail.com
Signed-off-by: Alexey Gladkov 
Link: https://lkml.kernel.org/r/000000000000f5004705e1db8bad@google.com
Link: https://lkml.kernel.org/r/20220622200729.2639663-1-legion@kernel.org
Signed-off-by: Eric W. Biederman

ipc: Store ipc sysctls in the ipc namespace

2022-03-08T19:39:40+00:00

The ipc sysctls are not available for modification inside the user
namespace. Following the mqueue sysctls, we changed the implementation
to be more userns friendly.

So far, the changes do not provide additional access to files. This
will be done in a future patch.

Signed-off-by: Alexey Gladkov 
Link: https://lkml.kernel.org/r/be6f9d014276f4dddd0c3aa05a86052856c1c555.1644862280.git.legion@kernel.org
Signed-off-by: Eric W. Biederman

ipc: Store mqueue sysctls in the ipc namespace

2022-03-08T19:39:40+00:00

Right now, the mqueue sysctls take ipc namespaces into account in a
rather hacky way. This works in most cases, but does not respect the
user namespace.

Within the user namespace, the user cannot change the /proc/sys/fs/mqueue/*
parametres. This poses a problem in the rootless containers.

To solve this I changed the implementation of the mqueue sysctls just
like some other sysctls.

So far, the changes do not provide additional access to files. This will
be done in a future patch.

v3:
* Don't implemenet set_permissions to keep the current behavior.

v2:
* Fixed compilation problem if CONFIG_POSIX_MQUEUE_SYSCTL is not
  specified.

Reported-by: kernel test robot 
Signed-off-by: Alexey Gladkov 
Link: https://lkml.kernel.org/r/b0ccbb2489119f1f20c737cf1930c3a9c4e4243a.1644862280.git.legion@kernel.org
Signed-off-by: Eric W. Biederman

memcg: enable accounting for new namesapces and struct nsproxy

2021-09-03T16:58:12+00:00

Container admin can create new namespaces and force kernel to allocate up
to several pages of memory for the namespaces and its associated
structures.

Net and uts namespaces have enabled accounting for such allocations.  It
makes sense to account for rest ones to restrict the host's memory
consumption from inside the memcg-limited container.

Link: https://lkml.kernel.org/r/5525bcbf-533e-da27-79b7-158686c64e13@virtuozzo.com
Signed-off-by: Vasily Averin 
Acked-by: Serge Hallyn 
Acked-by: Christian Brauner 
Acked-by: Kirill Tkhai 
Reviewed-by: Shakeel Butt 
Cc: Alexander Viro 
Cc: Alexey Dobriyan 
Cc: Andrei Vagin 
Cc: Borislav Petkov 
Cc: Borislav Petkov 
Cc: Dmitry Safonov <0x7f454c46@gmail.com>
Cc: "Eric W. Biederman" 
Cc: Greg Kroah-Hartman 
Cc: "H. Peter Anvin" 
Cc: Ingo Molnar 
Cc: "J. Bruce Fields" 
Cc: Jeff Layton 
Cc: Jens Axboe 
Cc: Jiri Slaby 
Cc: Johannes Weiner 
Cc: Michal Hocko 
Cc: Oleg Nesterov 
Cc: Roman Gushchin 
Cc: Tejun Heo 
Cc: Thomas Gleixner 
Cc: Vladimir Davydov 
Cc: Yutian Yang 
Cc: Zefan Li 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ipc: Use generic ns_common::count

2020-08-19T12:13:52+00:00

Switch over ipc namespaces to use the newly introduced common lifetime
counter.

Currently every namespace type has its own lifetime counter which is stored
in the specific namespace struct. The lifetime counters are used
identically for all namespaces types. Namespaces may of course have
additional unrelated counters and these are not altered.

This introduces a common lifetime counter into struct ns_common. The
ns_common struct encompasses information that all namespaces share. That
should include the lifetime counter since its common for all of them.

It also allows us to unify the type of the counters across all namespaces.
Most of them use refcount_t but one uses atomic_t and at least one uses
kref. Especially the last one doesn't make much sense since it's just a
wrapper around refcount_t since 2016 and actually complicates cleanup
operations by having to use container_of() to cast the correct namespace
struct out of struct ns_common.

Having the lifetime counter for the namespaces in one place reduces
maintenance cost. Not just because after switching all namespaces over we
will have removed more code than we added but also because the logic is
more easily understandable and we indicate to the user that the basic
lifetime requirements for all namespaces are currently identical.

Signed-off-by: Kirill Tkhai 
Reviewed-by: Kees Cook 
Acked-by: Christian Brauner 
Link: https://lore.kernel.org/r/159644978697.604812.16592754423881032385.stgit@localhost.localdomain
Signed-off-by: Christian Brauner

ipc/namespace.c: use a work queue to free_ipc

2020-06-08T18:05:56+00:00

the reason is to avoid a delay caused by the synchronize_rcu() call in
kern_umount() when the mqueue mount is freed.

the code:

    #define _GNU_SOURCE
    #include 
    #include 
    #include 
    #include 

    int main()
    {
        int i;

        for (i = 0; i < 1000; i++)
            if (unshare(CLONE_NEWIPC) < 0)
                error(EXIT_FAILURE, errno, "unshare");
    }

goes from

	Command being timed: "./ipc-namespace"
	User time (seconds): 0.00
	System time (seconds): 0.06
	Percent of CPU this job got: 0%
	Elapsed (wall clock) time (h:mm:ss or m:ss): 0:08.05

to

	Command being timed: "./ipc-namespace"
	User time (seconds): 0.00
	System time (seconds): 0.02
	Percent of CPU this job got: 96%
	Elapsed (wall clock) time (h:mm:ss or m:ss): 0:00.03

Signed-off-by: Giuseppe Scrivano 
Signed-off-by: Andrew Morton 
Reviewed-by: Paul E. McKenney 
Reviewed-by: Waiman Long 
Cc: Davidlohr Bueso 
Cc: Manfred Spraul 
Link: http://lkml.kernel.org/r/20200225145419.527994-1-gscrivan@redhat.com
Signed-off-by: Linus Torvalds