memcg: enable accounting for new namesapces and struct nsproxy

Container admin can create new namespaces and force kernel to allocate up
to several pages of memory for the namespaces and its associated
structures.

Net and uts namespaces have enabled accounting for such allocations.  It
makes sense to account for rest ones to restrict the host's memory
consumption from inside the memcg-limited container.

Link: https://lkml.kernel.org/r/5525bcbf-533e-da27-79b7-158686c64e13@virtuozzo.com
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Acked-by: Serge Hallyn <serge@hallyn.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Acked-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Reviewed-by: Shakeel Butt <shakeelb@google.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Andrei Vagin <avagin@gmail.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Borislav Petkov <bp@suse.de>
Cc: Dmitry Safonov <0x7f454c46@gmail.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "J. Bruce Fields" <bfields@fieldses.org>
Cc: Jeff Layton <jlayton@kernel.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Jiri Slaby <jirislaby@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Roman Gushchin <guro@fb.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Yutian Yang <nglaive@gmail.com>
Cc: Zefan Li <lizefan.x@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/fs/namespace.c b/fs/namespace.c
index e51b63ae233b533b29a557eccd936d437bc106aa..94a9817851cc4bda916a3a13a1ebcd54b48725d1 100644 (file)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -3307,7 +3307,7 @@ static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns, bool a
        if (!ucounts)
                return ERR_PTR(-ENOSPC);
 
-       new_ns = kzalloc(sizeof(struct mnt_namespace), GFP_KERNEL);
+       new_ns = kzalloc(sizeof(struct mnt_namespace), GFP_KERNEL_ACCOUNT);
        if (!new_ns) {
                dec_mnt_namespaces(ucounts);
                return ERR_PTR(-ENOMEM);

diff --git a/ipc/namespace.c b/ipc/namespace.c
index 7bd0766ddc3b13809e5ae912c49d266816475338..ae83f0f2651b7dad5acb3d7210c8ef47d4cca6a3 100644 (file)
--- a/ipc/namespace.c
+++ b/ipc/namespace.c
@@ -42,7 +42,7 @@ static struct ipc_namespace *create_ipc_ns(struct user_namespace *user_ns,
                goto fail;
 
        err = -ENOMEM;
-       ns = kzalloc(sizeof(struct ipc_namespace), GFP_KERNEL);
+       ns = kzalloc(sizeof(struct ipc_namespace), GFP_KERNEL_ACCOUNT);
        if (ns == NULL)
                goto fail_dec;
 

diff --git a/kernel/cgroup/namespace.c b/kernel/cgroup/namespace.c
index f5e8828c109cf8b5ab866d823d5dd6a1e58b4800..0d5c29879a50b78fba44058be31930b9f99615b3 100644 (file)
--- a/kernel/cgroup/namespace.c
+++ b/kernel/cgroup/namespace.c
@@ -24,7 +24,7 @@ static struct cgroup_namespace *alloc_cgroup_ns(void)
        struct cgroup_namespace *new_ns;
        int ret;
 
-       new_ns = kzalloc(sizeof(struct cgroup_namespace), GFP_KERNEL);
+       new_ns = kzalloc(sizeof(struct cgroup_namespace), GFP_KERNEL_ACCOUNT);
        if (!new_ns)
                return ERR_PTR(-ENOMEM);
        ret = ns_alloc_inum(&new_ns->ns);

diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index abc01fcad8c7ec9cc6de1970974d03a6b45abab0..eec72ca962e249c94266192b77a3c1f92ec8e889 100644 (file)
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -568,6 +568,6 @@ out:
 
 int __init nsproxy_cache_init(void)
 {
-       nsproxy_cachep = KMEM_CACHE(nsproxy, SLAB_PANIC);
+       nsproxy_cachep = KMEM_CACHE(nsproxy, SLAB_PANIC|SLAB_ACCOUNT);
        return 0;
 }

diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index cb5a25a8a0cc7d92c8b9f1cd2952f9c4498553f2..a46a3723bc66271836a0ffdd42706190c23095f2 100644 (file)
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -450,7 +450,7 @@ const struct proc_ns_operations pidns_for_children_operations = {
 
 static __init int pid_namespaces_init(void)
 {
-       pid_ns_cachep = KMEM_CACHE(pid_namespace, SLAB_PANIC);
+       pid_ns_cachep = KMEM_CACHE(pid_namespace, SLAB_PANIC | SLAB_ACCOUNT);
 
 #ifdef CONFIG_CHECKPOINT_RESTORE
        register_sysctl_paths(kern_path, pid_ns_ctl_table);

diff --git a/kernel/time/namespace.c b/kernel/time/namespace.c
index 12eab0d2ae28d29b9c9a86da992f1aca0972ecbd..aec832801c26ca111eaa1d7675b6bfc7c3e4b850 100644 (file)
--- a/kernel/time/namespace.c
+++ b/kernel/time/namespace.c
@@ -88,13 +88,13 @@ static struct time_namespace *clone_time_ns(struct user_namespace *user_ns,
                goto fail;
 
        err = -ENOMEM;
-       ns = kmalloc(sizeof(*ns), GFP_KERNEL);
+       ns = kmalloc(sizeof(*ns), GFP_KERNEL_ACCOUNT);
        if (!ns)
                goto fail_dec;
 
        refcount_set(&ns->ns.count, 1);
 
-       ns->vvar_page = alloc_page(GFP_KERNEL | __GFP_ZERO);
+       ns->vvar_page = alloc_page(GFP_KERNEL_ACCOUNT | __GFP_ZERO);
        if (!ns->vvar_page)
                goto fail_free;
 

diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index ef82d401dde83a7f4ba8486db45ad65c8f5d1df2..6b2e3ca7ee993a7b0ff4fa44a6450770661106dc 100644 (file)
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -1385,7 +1385,7 @@ const struct proc_ns_operations userns_operations = {
 
 static __init int user_namespaces_init(void)
 {
-       user_ns_cachep = KMEM_CACHE(user_namespace, SLAB_PANIC);
+       user_ns_cachep = KMEM_CACHE(user_namespace, SLAB_PANIC | SLAB_ACCOUNT);
        return 0;
 }
 subsys_initcall(user_namespaces_init);