1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* |
3 | * Process number limiting controller for cgroups. |
4 | * |
5 | * Used to allow a cgroup hierarchy to stop any new processes from fork()ing |
6 | * after a certain limit is reached. |
7 | * |
8 | * Since it is trivial to hit the task limit without hitting any kmemcg limits |
9 | * in place, PIDs are a fundamental resource. As such, PID exhaustion must be |
10 | * preventable in the scope of a cgroup hierarchy by allowing resource limiting |
11 | * of the number of tasks in a cgroup. |
12 | * |
13 | * In order to use the `pids` controller, set the maximum number of tasks in |
14 | * pids.max (this is not available in the root cgroup for obvious reasons). The |
15 | * number of processes currently in the cgroup is given by pids.current. |
16 | * Organisational operations are not blocked by cgroup policies, so it is |
17 | * possible to have pids.current > pids.max. However, it is not possible to |
18 | * violate a cgroup policy through fork(). fork() will return -EAGAIN if forking |
19 | * would cause a cgroup policy to be violated. |
20 | * |
21 | * To set a cgroup to have no limit, set pids.max to "max". This is the default |
22 | * for all new cgroups (N.B. that PID limits are hierarchical, so the most |
23 | * stringent limit in the hierarchy is followed). |
24 | * |
25 | * pids.current tracks all child cgroup hierarchies, so parent/pids.current is |
26 | * a superset of parent/child/pids.current. |
27 | * |
28 | * Copyright (C) 2015 Aleksa Sarai <cyphar@cyphar.com> |
29 | */ |
30 | |
31 | #include <linux/kernel.h> |
32 | #include <linux/threads.h> |
33 | #include <linux/atomic.h> |
34 | #include <linux/cgroup.h> |
35 | #include <linux/slab.h> |
36 | #include <linux/sched/task.h> |
37 | |
38 | #define PIDS_MAX (PID_MAX_LIMIT + 1ULL) |
39 | #define PIDS_MAX_STR "max" |
40 | |
41 | struct pids_cgroup { |
42 | struct cgroup_subsys_state css; |
43 | |
44 | /* |
45 | * Use 64-bit types so that we can safely represent "max" as |
46 | * %PIDS_MAX = (%PID_MAX_LIMIT + 1). |
47 | */ |
48 | atomic64_t counter; |
49 | atomic64_t limit; |
50 | int64_t watermark; |
51 | |
52 | /* Handle for "pids.events" */ |
53 | struct cgroup_file events_file; |
54 | |
55 | /* Number of times fork failed because limit was hit. */ |
56 | atomic64_t events_limit; |
57 | }; |
58 | |
59 | static struct pids_cgroup *css_pids(struct cgroup_subsys_state *css) |
60 | { |
61 | return container_of(css, struct pids_cgroup, css); |
62 | } |
63 | |
64 | static struct pids_cgroup *parent_pids(struct pids_cgroup *pids) |
65 | { |
66 | return css_pids(css: pids->css.parent); |
67 | } |
68 | |
69 | static struct cgroup_subsys_state * |
70 | pids_css_alloc(struct cgroup_subsys_state *parent) |
71 | { |
72 | struct pids_cgroup *pids; |
73 | |
74 | pids = kzalloc(size: sizeof(struct pids_cgroup), GFP_KERNEL); |
75 | if (!pids) |
76 | return ERR_PTR(error: -ENOMEM); |
77 | |
78 | atomic64_set(v: &pids->counter, i: 0); |
79 | atomic64_set(v: &pids->limit, PIDS_MAX); |
80 | atomic64_set(v: &pids->events_limit, i: 0); |
81 | return &pids->css; |
82 | } |
83 | |
84 | static void pids_css_free(struct cgroup_subsys_state *css) |
85 | { |
86 | kfree(objp: css_pids(css)); |
87 | } |
88 | |
89 | static void pids_update_watermark(struct pids_cgroup *p, int64_t nr_pids) |
90 | { |
91 | /* |
92 | * This is racy, but we don't need perfectly accurate tallying of |
93 | * the watermark, and this lets us avoid extra atomic overhead. |
94 | */ |
95 | if (nr_pids > READ_ONCE(p->watermark)) |
96 | WRITE_ONCE(p->watermark, nr_pids); |
97 | } |
98 | |
99 | /** |
100 | * pids_cancel - uncharge the local pid count |
101 | * @pids: the pid cgroup state |
102 | * @num: the number of pids to cancel |
103 | * |
104 | * This function will WARN if the pid count goes under 0, because such a case is |
105 | * a bug in the pids controller proper. |
106 | */ |
107 | static void pids_cancel(struct pids_cgroup *pids, int num) |
108 | { |
109 | /* |
110 | * A negative count (or overflow for that matter) is invalid, |
111 | * and indicates a bug in the `pids` controller proper. |
112 | */ |
113 | WARN_ON_ONCE(atomic64_add_negative(-num, &pids->counter)); |
114 | } |
115 | |
116 | /** |
117 | * pids_uncharge - hierarchically uncharge the pid count |
118 | * @pids: the pid cgroup state |
119 | * @num: the number of pids to uncharge |
120 | */ |
121 | static void pids_uncharge(struct pids_cgroup *pids, int num) |
122 | { |
123 | struct pids_cgroup *p; |
124 | |
125 | for (p = pids; parent_pids(pids: p); p = parent_pids(pids: p)) |
126 | pids_cancel(pids: p, num); |
127 | } |
128 | |
129 | /** |
130 | * pids_charge - hierarchically charge the pid count |
131 | * @pids: the pid cgroup state |
132 | * @num: the number of pids to charge |
133 | * |
134 | * This function does *not* follow the pid limit set. It cannot fail and the new |
135 | * pid count may exceed the limit. This is only used for reverting failed |
136 | * attaches, where there is no other way out than violating the limit. |
137 | */ |
138 | static void pids_charge(struct pids_cgroup *pids, int num) |
139 | { |
140 | struct pids_cgroup *p; |
141 | |
142 | for (p = pids; parent_pids(pids: p); p = parent_pids(pids: p)) { |
143 | int64_t new = atomic64_add_return(i: num, v: &p->counter); |
144 | |
145 | pids_update_watermark(p, nr_pids: new); |
146 | } |
147 | } |
148 | |
149 | /** |
150 | * pids_try_charge - hierarchically try to charge the pid count |
151 | * @pids: the pid cgroup state |
152 | * @num: the number of pids to charge |
153 | * |
154 | * This function follows the set limit. It will fail if the charge would cause |
155 | * the new value to exceed the hierarchical limit. Returns 0 if the charge |
156 | * succeeded, otherwise -EAGAIN. |
157 | */ |
158 | static int pids_try_charge(struct pids_cgroup *pids, int num) |
159 | { |
160 | struct pids_cgroup *p, *q; |
161 | |
162 | for (p = pids; parent_pids(pids: p); p = parent_pids(pids: p)) { |
163 | int64_t new = atomic64_add_return(i: num, v: &p->counter); |
164 | int64_t limit = atomic64_read(v: &p->limit); |
165 | |
166 | /* |
167 | * Since new is capped to the maximum number of pid_t, if |
168 | * p->limit is %PIDS_MAX then we know that this test will never |
169 | * fail. |
170 | */ |
171 | if (new > limit) |
172 | goto revert; |
173 | |
174 | /* |
175 | * Not technically accurate if we go over limit somewhere up |
176 | * the hierarchy, but that's tolerable for the watermark. |
177 | */ |
178 | pids_update_watermark(p, nr_pids: new); |
179 | } |
180 | |
181 | return 0; |
182 | |
183 | revert: |
184 | for (q = pids; q != p; q = parent_pids(pids: q)) |
185 | pids_cancel(pids: q, num); |
186 | pids_cancel(pids: p, num); |
187 | |
188 | return -EAGAIN; |
189 | } |
190 | |
191 | static int pids_can_attach(struct cgroup_taskset *tset) |
192 | { |
193 | struct task_struct *task; |
194 | struct cgroup_subsys_state *dst_css; |
195 | |
196 | cgroup_taskset_for_each(task, dst_css, tset) { |
197 | struct pids_cgroup *pids = css_pids(css: dst_css); |
198 | struct cgroup_subsys_state *old_css; |
199 | struct pids_cgroup *old_pids; |
200 | |
201 | /* |
202 | * No need to pin @old_css between here and cancel_attach() |
203 | * because cgroup core protects it from being freed before |
204 | * the migration completes or fails. |
205 | */ |
206 | old_css = task_css(task, subsys_id: pids_cgrp_id); |
207 | old_pids = css_pids(css: old_css); |
208 | |
209 | pids_charge(pids, num: 1); |
210 | pids_uncharge(pids: old_pids, num: 1); |
211 | } |
212 | |
213 | return 0; |
214 | } |
215 | |
216 | static void pids_cancel_attach(struct cgroup_taskset *tset) |
217 | { |
218 | struct task_struct *task; |
219 | struct cgroup_subsys_state *dst_css; |
220 | |
221 | cgroup_taskset_for_each(task, dst_css, tset) { |
222 | struct pids_cgroup *pids = css_pids(css: dst_css); |
223 | struct cgroup_subsys_state *old_css; |
224 | struct pids_cgroup *old_pids; |
225 | |
226 | old_css = task_css(task, subsys_id: pids_cgrp_id); |
227 | old_pids = css_pids(css: old_css); |
228 | |
229 | pids_charge(pids: old_pids, num: 1); |
230 | pids_uncharge(pids, num: 1); |
231 | } |
232 | } |
233 | |
234 | /* |
235 | * task_css_check(true) in pids_can_fork() and pids_cancel_fork() relies |
236 | * on cgroup_threadgroup_change_begin() held by the copy_process(). |
237 | */ |
238 | static int pids_can_fork(struct task_struct *task, struct css_set *cset) |
239 | { |
240 | struct cgroup_subsys_state *css; |
241 | struct pids_cgroup *pids; |
242 | int err; |
243 | |
244 | if (cset) |
245 | css = cset->subsys[pids_cgrp_id]; |
246 | else |
247 | css = task_css_check(current, pids_cgrp_id, true); |
248 | pids = css_pids(css); |
249 | err = pids_try_charge(pids, num: 1); |
250 | if (err) { |
251 | /* Only log the first time events_limit is incremented. */ |
252 | if (atomic64_inc_return(v: &pids->events_limit) == 1) { |
253 | pr_info("cgroup: fork rejected by pids controller in " ); |
254 | pr_cont_cgroup_path(cgrp: css->cgroup); |
255 | pr_cont("\n" ); |
256 | } |
257 | cgroup_file_notify(cfile: &pids->events_file); |
258 | } |
259 | return err; |
260 | } |
261 | |
262 | static void pids_cancel_fork(struct task_struct *task, struct css_set *cset) |
263 | { |
264 | struct cgroup_subsys_state *css; |
265 | struct pids_cgroup *pids; |
266 | |
267 | if (cset) |
268 | css = cset->subsys[pids_cgrp_id]; |
269 | else |
270 | css = task_css_check(current, pids_cgrp_id, true); |
271 | pids = css_pids(css); |
272 | pids_uncharge(pids, num: 1); |
273 | } |
274 | |
275 | static void pids_release(struct task_struct *task) |
276 | { |
277 | struct pids_cgroup *pids = css_pids(css: task_css(task, subsys_id: pids_cgrp_id)); |
278 | |
279 | pids_uncharge(pids, num: 1); |
280 | } |
281 | |
282 | static ssize_t pids_max_write(struct kernfs_open_file *of, char *buf, |
283 | size_t nbytes, loff_t off) |
284 | { |
285 | struct cgroup_subsys_state *css = of_css(of); |
286 | struct pids_cgroup *pids = css_pids(css); |
287 | int64_t limit; |
288 | int err; |
289 | |
290 | buf = strstrip(str: buf); |
291 | if (!strcmp(buf, PIDS_MAX_STR)) { |
292 | limit = PIDS_MAX; |
293 | goto set_limit; |
294 | } |
295 | |
296 | err = kstrtoll(s: buf, base: 0, res: &limit); |
297 | if (err) |
298 | return err; |
299 | |
300 | if (limit < 0 || limit >= PIDS_MAX) |
301 | return -EINVAL; |
302 | |
303 | set_limit: |
304 | /* |
305 | * Limit updates don't need to be mutex'd, since it isn't |
306 | * critical that any racing fork()s follow the new limit. |
307 | */ |
308 | atomic64_set(v: &pids->limit, i: limit); |
309 | return nbytes; |
310 | } |
311 | |
312 | static int pids_max_show(struct seq_file *sf, void *v) |
313 | { |
314 | struct cgroup_subsys_state *css = seq_css(seq: sf); |
315 | struct pids_cgroup *pids = css_pids(css); |
316 | int64_t limit = atomic64_read(v: &pids->limit); |
317 | |
318 | if (limit >= PIDS_MAX) |
319 | seq_printf(m: sf, fmt: "%s\n" , PIDS_MAX_STR); |
320 | else |
321 | seq_printf(m: sf, fmt: "%lld\n" , limit); |
322 | |
323 | return 0; |
324 | } |
325 | |
326 | static s64 pids_current_read(struct cgroup_subsys_state *css, |
327 | struct cftype *cft) |
328 | { |
329 | struct pids_cgroup *pids = css_pids(css); |
330 | |
331 | return atomic64_read(v: &pids->counter); |
332 | } |
333 | |
334 | static s64 pids_peak_read(struct cgroup_subsys_state *css, |
335 | struct cftype *cft) |
336 | { |
337 | struct pids_cgroup *pids = css_pids(css); |
338 | |
339 | return READ_ONCE(pids->watermark); |
340 | } |
341 | |
342 | static int pids_events_show(struct seq_file *sf, void *v) |
343 | { |
344 | struct pids_cgroup *pids = css_pids(css: seq_css(seq: sf)); |
345 | |
346 | seq_printf(m: sf, fmt: "max %lld\n" , (s64)atomic64_read(v: &pids->events_limit)); |
347 | return 0; |
348 | } |
349 | |
350 | static struct cftype pids_files[] = { |
351 | { |
352 | .name = "max" , |
353 | .write = pids_max_write, |
354 | .seq_show = pids_max_show, |
355 | .flags = CFTYPE_NOT_ON_ROOT, |
356 | }, |
357 | { |
358 | .name = "current" , |
359 | .read_s64 = pids_current_read, |
360 | .flags = CFTYPE_NOT_ON_ROOT, |
361 | }, |
362 | { |
363 | .name = "peak" , |
364 | .flags = CFTYPE_NOT_ON_ROOT, |
365 | .read_s64 = pids_peak_read, |
366 | }, |
367 | { |
368 | .name = "events" , |
369 | .seq_show = pids_events_show, |
370 | .file_offset = offsetof(struct pids_cgroup, events_file), |
371 | .flags = CFTYPE_NOT_ON_ROOT, |
372 | }, |
373 | { } /* terminate */ |
374 | }; |
375 | |
376 | struct cgroup_subsys pids_cgrp_subsys = { |
377 | .css_alloc = pids_css_alloc, |
378 | .css_free = pids_css_free, |
379 | .can_attach = pids_can_attach, |
380 | .cancel_attach = pids_cancel_attach, |
381 | .can_fork = pids_can_fork, |
382 | .cancel_fork = pids_cancel_fork, |
383 | .release = pids_release, |
384 | .legacy_cftypes = pids_files, |
385 | .dfl_cftypes = pids_files, |
386 | .threaded = true, |
387 | }; |
388 | |