mirror of
https://github.com/torvalds/linux.git
synced 2024-12-12 14:12:51 +00:00
2939e1a86f
Problem statement: unprivileged user who has read-write access to more than one btrfs subvolume may easily consume all kernel memory (eventually triggering oom-killer). Reproducer (./mkrmdir below essentially loops over mkdir/rmdir): [root@kteam1 ~]# cat prep.sh DEV=/dev/sdb mkfs.btrfs -f $DEV mount $DEV /mnt for i in `seq 1 16` do mkdir /mnt/$i btrfs subvolume create /mnt/SV_$i ID=`btrfs subvolume list /mnt |grep "SV_$i$" |cut -d ' ' -f 2` mount -t btrfs -o subvolid=$ID $DEV /mnt/$i chmod a+rwx /mnt/$i done [root@kteam1 ~]# sh prep.sh [maxim@kteam1 ~]$ for i in `seq 1 16`; do ./mkrmdir /mnt/$i 2000 2000 & done [root@kteam1 ~]# for i in `seq 1 4`; do grep "kmalloc-128" /proc/slabinfo | grep -v dma; sleep 60; done kmalloc-128 10144 10144 128 32 1 : tunables 0 0 0 : slabdata 317 317 0 kmalloc-128 9992352 9992352 128 32 1 : tunables 0 0 0 : slabdata 312261 312261 0 kmalloc-128 24226752 24226752 128 32 1 : tunables 0 0 0 : slabdata 757086 757086 0 kmalloc-128 42754240 42754240 128 32 1 : tunables 0 0 0 : slabdata 1336070 1336070 0 The huge numbers above come from insane number of async_work-s allocated and queued by btrfs_wq_run_delayed_node. The problem is caused by btrfs_wq_run_delayed_node() queuing more and more works if the number of delayed items is above BTRFS_DELAYED_BACKGROUND. The worker func (btrfs_async_run_delayed_root) processes at least BTRFS_DELAYED_BATCH items (if they are present in the list). So, the machinery works as expected while the list is almost empty. As soon as it is getting bigger, worker func starts to process more than one item at a time, it takes longer, and the chances to have async_works queued more than needed is getting higher. The problem above is worsened by another flaw of delayed-inode implementation: if async_work was queued in a throttling branch (number of items >= BTRFS_DELAYED_WRITEBACK), corresponding worker func won't quit until the number of items < BTRFS_DELAYED_BACKGROUND / 2. So, it is possible that the func occupies CPU infinitely (up to 30sec in my experiments): while the func is trying to drain the list, the user activity may add more and more items to the list. The patch fixes both problems in straightforward way: refuse queuing too many works in btrfs_wq_run_delayed_node and bail out of worker func if at least BTRFS_DELAYED_WRITEBACK items are processed. Changed in v2: remove support of thresh == NO_THRESHOLD. Signed-off-by: Maxim Patlasov <mpatlasov@virtuozzo.com> Signed-off-by: Chris Mason <clm@fb.com> Cc: stable@vger.kernel.org # v3.15+
89 lines
3.1 KiB
C
89 lines
3.1 KiB
C
/*
|
|
* Copyright (C) 2007 Oracle. All rights reserved.
|
|
* Copyright (C) 2014 Fujitsu. All rights reserved.
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public
|
|
* License v2 as published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public
|
|
* License along with this program; if not, write to the
|
|
* Free Software Foundation, Inc., 59 Temple Place - Suite 330,
|
|
* Boston, MA 021110-1307, USA.
|
|
*/
|
|
|
|
#ifndef __BTRFS_ASYNC_THREAD_
|
|
#define __BTRFS_ASYNC_THREAD_
|
|
#include <linux/workqueue.h>
|
|
|
|
struct btrfs_fs_info;
|
|
struct btrfs_workqueue;
|
|
/* Internal use only */
|
|
struct __btrfs_workqueue;
|
|
struct btrfs_work;
|
|
typedef void (*btrfs_func_t)(struct btrfs_work *arg);
|
|
typedef void (*btrfs_work_func_t)(struct work_struct *arg);
|
|
|
|
struct btrfs_work {
|
|
btrfs_func_t func;
|
|
btrfs_func_t ordered_func;
|
|
btrfs_func_t ordered_free;
|
|
|
|
/* Don't touch things below */
|
|
struct work_struct normal_work;
|
|
struct list_head ordered_list;
|
|
struct __btrfs_workqueue *wq;
|
|
unsigned long flags;
|
|
};
|
|
|
|
#define BTRFS_WORK_HELPER_PROTO(name) \
|
|
void btrfs_##name(struct work_struct *arg)
|
|
|
|
BTRFS_WORK_HELPER_PROTO(worker_helper);
|
|
BTRFS_WORK_HELPER_PROTO(delalloc_helper);
|
|
BTRFS_WORK_HELPER_PROTO(flush_delalloc_helper);
|
|
BTRFS_WORK_HELPER_PROTO(cache_helper);
|
|
BTRFS_WORK_HELPER_PROTO(submit_helper);
|
|
BTRFS_WORK_HELPER_PROTO(fixup_helper);
|
|
BTRFS_WORK_HELPER_PROTO(endio_helper);
|
|
BTRFS_WORK_HELPER_PROTO(endio_meta_helper);
|
|
BTRFS_WORK_HELPER_PROTO(endio_meta_write_helper);
|
|
BTRFS_WORK_HELPER_PROTO(endio_raid56_helper);
|
|
BTRFS_WORK_HELPER_PROTO(endio_repair_helper);
|
|
BTRFS_WORK_HELPER_PROTO(rmw_helper);
|
|
BTRFS_WORK_HELPER_PROTO(endio_write_helper);
|
|
BTRFS_WORK_HELPER_PROTO(freespace_write_helper);
|
|
BTRFS_WORK_HELPER_PROTO(delayed_meta_helper);
|
|
BTRFS_WORK_HELPER_PROTO(readahead_helper);
|
|
BTRFS_WORK_HELPER_PROTO(qgroup_rescan_helper);
|
|
BTRFS_WORK_HELPER_PROTO(extent_refs_helper);
|
|
BTRFS_WORK_HELPER_PROTO(scrub_helper);
|
|
BTRFS_WORK_HELPER_PROTO(scrubwrc_helper);
|
|
BTRFS_WORK_HELPER_PROTO(scrubnc_helper);
|
|
BTRFS_WORK_HELPER_PROTO(scrubparity_helper);
|
|
|
|
|
|
struct btrfs_workqueue *btrfs_alloc_workqueue(struct btrfs_fs_info *fs_info,
|
|
const char *name,
|
|
unsigned int flags,
|
|
int limit_active,
|
|
int thresh);
|
|
void btrfs_init_work(struct btrfs_work *work, btrfs_work_func_t helper,
|
|
btrfs_func_t func,
|
|
btrfs_func_t ordered_func,
|
|
btrfs_func_t ordered_free);
|
|
void btrfs_queue_work(struct btrfs_workqueue *wq,
|
|
struct btrfs_work *work);
|
|
void btrfs_destroy_workqueue(struct btrfs_workqueue *wq);
|
|
void btrfs_workqueue_set_max(struct btrfs_workqueue *wq, int max);
|
|
void btrfs_set_work_high_priority(struct btrfs_work *work);
|
|
struct btrfs_fs_info *btrfs_work_owner(struct btrfs_work *work);
|
|
struct btrfs_fs_info *btrfs_workqueue_owner(struct __btrfs_workqueue *wq);
|
|
bool btrfs_workqueue_normal_congested(struct btrfs_workqueue *wq);
|
|
#endif
|