diff mbox

Lucid SRU - UBUNTU: SAUCE: netns: Add quota for number of NET_NS instances.

Message ID 4EEF6477.9020202@canonical.com
State New
Headers show

Commit Message

Tim Gardner Dec. 19, 2011, 4:21 p.m. UTC 
On 12/19/2011 08:32 AM, Serge Hallyn wrote:
> Quoting Brad Figg (brad.figg@canonical.com):
>> On 12/01/2011 01:48 PM, Tim Gardner wrote:
>>> Please consider this (untested) patch for inclusion in Lucid. See the discussion in http://bugs.launchpad.net/bugs/790863 for arguments proposing to restore CONFIG_NET_NS.
>>>
>>> I'll post a test kernel to the bug in awhile.
>>>
>>> One of the issues I have with this patch is that it appears that any consumer of network name spaces will have to initially write a non-zero value to netns_max before _any_ name spaces can be successfully allocated. If copy_net_ns() fails in
>>> create_new_namespaces(), then it seems the whole allocation is buggered.
>>>
>>> rtg
>>>
>>>
>>
>> Tim,
>>
>> If you follow the thread that starts at:
>> http://www.spinics.net/lists/netdev/msg180263.html
>> you will see that Tetsuo actually proposed a modified
>> version of this patch: http://www.spinics.net/lists/netdev/msg180360.html.
>
> (Shouldn't used_netns_count default to 1?  :)
>
> It looks good, I'd only ask that a warning be printed, even if only
> printk_once(), when the limit is hit.  Otherwise we risk mysterious
> bugs reported against other software.
>
> Acked-by: Serge Hallyn<serge.hallyn@canonical.com>
>
> thanks,
> -serge

Serge - How about this? Changes include a non-zero initial value for 
max_netns_count, and a printk_once() warning if the count is ever exceeded.

rtg

Comments

Serge Hallyn Dec. 19, 2011, 4:31 p.m. UTC | #1 
Quoting Tim Gardner (tim.gardner@canonical.com):
> On 12/19/2011 08:32 AM, Serge Hallyn wrote:
> >Quoting Brad Figg (brad.figg@canonical.com):
> >>On 12/01/2011 01:48 PM, Tim Gardner wrote:
> >>>Please consider this (untested) patch for inclusion in Lucid. See the discussion in http://bugs.launchpad.net/bugs/790863 for arguments proposing to restore CONFIG_NET_NS.
> >>>
> >>>I'll post a test kernel to the bug in awhile.
> >>>
> >>>One of the issues I have with this patch is that it appears that any consumer of network name spaces will have to initially write a non-zero value to netns_max before _any_ name spaces can be successfully allocated. If copy_net_ns() fails in
> >>>create_new_namespaces(), then it seems the whole allocation is buggered.
> >>>
> >>>rtg
> >>>
> >>>
> >>
> >>Tim,
> >>
> >>If you follow the thread that starts at:
> >>http://www.spinics.net/lists/netdev/msg180263.html
> >>you will see that Tetsuo actually proposed a modified
> >>version of this patch: http://www.spinics.net/lists/netdev/msg180360.html.
> >
> >(Shouldn't used_netns_count default to 1?  :)
> >
> >It looks good, I'd only ask that a warning be printed, even if only
> >printk_once(), when the limit is hit.  Otherwise we risk mysterious
> >bugs reported against other software.
> >
> >Acked-by: Serge Hallyn<serge.hallyn@canonical.com>
> >
> >thanks,
> >-serge
> 
> Serge - How about this? Changes include a non-zero initial value for
> max_netns_count, and a printk_once() warning if the count is ever
> exceeded.

Looks great, thanks.

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>

-serge
Tim Gardner Dec. 19, 2011, 4:50 p.m. UTC | #2 
On 12/19/2011 09:31 AM, Serge Hallyn wrote:
> Serge Hallyn<serge.hallyn@canonical.com>
diff mbox

Patch

From 2510c5664eabb0a53cfccb571ed137e47d87f9df Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Date: Thu, 1 Dec 2011 14:28:04 -0700
Subject: [PATCH 1/2] UBUNTU: SAUCE: netns: Add quota for number of NET_NS instances.

CONFIG_NET_NS support in 2.6.32 has a problem that leads to OOM killer when
clone(CLONE_NEWNET) is called instantly.
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/720095
But disabling CONFIG_NET_NS broke lxc containers.
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/790863

This patch introduces /proc/sys/net/core/netns_max interface that limits
max number of network namespace instances.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
---
 include/net/sock.h         |    4 ++++
 net/core/net_namespace.c   |   13 +++++++++++++
 net/core/sysctl_net_core.c |   10 ++++++++++
 3 files changed, 27 insertions(+), 0 deletions(-)

diff --git a/include/net/sock.h b/include/net/sock.h
index 4babe89..3cd628c 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1620,4 +1620,8 @@  extern int sysctl_optmem_max;
 extern __u32 sysctl_wmem_default;
 extern __u32 sysctl_rmem_default;
 
+#ifdef CONFIG_NET_NS
+extern int max_netns_count;
+#endif
+
 #endif	/* _SOCK_H */
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 1c1af27..841df10 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -81,12 +81,22 @@  static struct net_generic *net_alloc_generic(void)
 #ifdef CONFIG_NET_NS
 static struct kmem_cache *net_cachep;
 static struct workqueue_struct *netns_wq;
+static atomic_t used_netns_count = ATOMIC_INIT(0);
+unsigned int max_netns_count = 1024;
 
 static struct net *net_alloc(void)
 {
 	struct net *net = NULL;
 	struct net_generic *ng;
 
+	atomic_inc(&used_netns_count);
+	if (atomic_read(&used_netns_count) >= max_netns_count) {
+		printk_once(KERN_WARNING
+			"net_alloc: Exceeded maximum (%d) net namespace allocations.\n",
+			max_netns_count);
+		goto out;
+	}
+
 	ng = net_alloc_generic();
 	if (!ng)
 		goto out;
@@ -96,7 +106,9 @@  static struct net *net_alloc(void)
 		goto out_free;
 
 	rcu_assign_pointer(net->gen, ng);
+	return net;
 out:
+	atomic_dec(&used_netns_count);
 	return net;
 
 out_free:
@@ -115,6 +127,7 @@  static void net_free(struct net *net)
 #endif
 	kfree(net->gen);
 	kmem_cache_free(net_cachep, net);
+	atomic_dec(&used_netns_count);
 }
 
 static struct net *net_create(void)
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index 7db1de0..81c79df 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -89,6 +89,16 @@  static struct ctl_table net_core_table[] = {
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec
 	},
+#ifdef CONFIG_NET_NS
+	{
+		.ctl_name       = CTL_UNNUMBERED,
+		.procname       = "netns_max",
+		.data           = &max_netns_count,
+		.maxlen         = sizeof(int),
+		.mode           = 0644,
+		.proc_handler   = proc_dointvec,
+	},
+#endif
 #endif /* CONFIG_NET */
 	{
 		.ctl_name	= NET_CORE_BUDGET,
-- 
1.7.0.4