Willy Tarreau fa6d0ba12a pipe: limit the per-user amount of pages allocated in pipes ... commit 759c01142a5d0f364a462346168a56de28a80f52 upstream. On no-so-small systems, it is possible for a single process to cause an OOM condition by filling large pipes with data that are never read. A typical process filling 4000 pipes with 1 MB of data will use 4 GB of memory. On small systems it may be tricky to set the pipe max size to prevent this from happening. This patch makes it possible to enforce a per-user soft limit above which new pipes will be limited to a single page, effectively limiting them to 4 kB each, as well as a hard limit above which no new pipes may be created for this user. This has the effect of protecting the system against memory abuse without hurting other users, and still allowing pipes to work correctly though with less data at once. The limit are controlled by two new sysctls : pipe-user-pages-soft, and pipe-user-pages-hard. Both may be disabled by setting them to zero. The default soft limit allows the default number of FDs per process (1024) to create pipes of the default size (64kB), thus reaching a limit of 64MB before starting to create only smaller pipes. With 256 processes limited to 1024 FDs each, this results in 1024*64kB + (256*1024 - 1024) * 4kB = 1084 MB of memory allocated for a user. The hard limit is disabled by default to avoid breaking existing applications that make intensive use of pipes (eg: for splicing). Reported-by: socketpair@gmail.com Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Mitigates: CVE-2013-4312 (Linux 2.0+) Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Willy Tarreau <w@1wt.eu> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Cc: Moritz Muehlenhoff <moritz@wikimedia.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2016-06-07 18:14:35 -07:00
..
bpf	bpf: fix check_map_func_compatibility logic	2016-05-18 17:06:38 -07:00
configs
debug
events	perf/core: Fix perf_event_open() vs. execve() race	2016-06-01 12:15:47 -07:00
gcov
irq	genirq: Validate action before dereferencing it in handle_irq_event_percpu()	2016-03-03 15:07:11 -08:00
livepatch	livepatch: x86: fix relocation computation with kASLR	2015-11-11 17:36:04 +01:00
locking	locking/mcs: Fix mcs_spin_lock() ordering	2016-05-04 14:48:50 -07:00
power	PM / sleep: Clear pm_suspend_global_flags upon hibernate	2016-04-12 09:09:05 -07:00
printk	printk: do cond_resched() between lines while outputting to consoles	2016-02-17 12:30:57 -08:00
rcu	Merge branches 'doc.2015.10.06a', 'percpu-rwsem.2015.10.06a' and 'torture.2015.10.06a' into HEAD	2015-10-07 16:06:25 -07:00
sched	sched/loadavg: Fix loadavg artifacts on fully idle and on fully loaded systems	2016-06-01 12:15:49 -07:00
time	tick/nohz: Set the correct expiry when switching to nohz/lowres mode	2016-03-03 15:07:26 -08:00
trace	ring-buffer: Prevent overflow of size in ring_buffer_resize()	2016-06-01 12:15:49 -07:00
.gitignore	certs: add .gitignore to stop git nagging about x509_certificate_list	2015-10-21 15:18:35 +01:00
acct.c
async.c
audit.c	mm, page_alloc: distinguish between being unable to sleep, unwilling to sleep and avoiding waking kswapd	2015-11-06 17:50:42 -08:00
audit.h	audit: audit_tree_match can be boolean	2015-11-04 08:23:51 -05:00
audit_fsnotify.c	audit: clean simple fsnotify implementation	2015-08-06 16:14:53 -04:00
audit_tree.c	audit: audit_tree_match can be boolean	2015-11-04 08:23:51 -05:00
audit_watch.c	Merge branch 'upstream' of git://git.infradead.org/users/pcmoore/audit	2015-09-08 13:34:59 -07:00
auditfilter.c	audit: fix comment block whitespace	2015-11-04 08:23:51 -05:00
auditsc.c	Merge branch 'upstream' of git://git.infradead.org/users/pcmoore/audit	2015-09-08 13:34:59 -07:00
backtracetest.c
bounds.c
capability.c
cgroup.c	cgroup: make sure a parent css isn't freed before its children	2016-05-04 14:48:49 -07:00
cgroup_freezer.c	cgroup: fix handling of multi-destination migration from subtree_control enabling	2015-12-03 10:18:21 -05:00
cgroup_pids.c	cgroup_pids: don't account for the root cgroup	2015-12-03 10:18:21 -05:00
compat.c
configs.c
context_tracking.c	context_tracking: avoid irq_save/irq_restore on guest entry and exit	2015-11-10 12:06:23 +01:00
cpu.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2015-11-03 18:03:50 -08:00
cpu_pm.c	kernel/cpu_pm: fix cpu_cluster_pm_exit comment	2015-09-03 02:42:20 +02:00
cpuset.c	cgroup, cpuset: replace cpuset_post_attach_flush() with cgroup_subsys->post_attach callback	2016-05-04 14:48:49 -07:00
crash_dump.c
cred.c	kernel/cred.c: remove unnecessary kdebug atomic reads	2015-09-10 13:29:01 -07:00
delayacct.c
dma.c
elfcore.c
exec_domain.c
exit.c	wait/ptrace: assume __WALL if the child is traced	2016-06-07 18:14:35 -07:00
extable.c	kernel/extable.c: remove duplicated include	2015-09-10 13:29:01 -07:00
fork.c	sched/core: Reset task's lockless wake-queues on fork()	2016-01-06 11:01:07 +01:00
freezer.c
futex.c	futex: Acknowledge a new waiter in counter before plist	2016-05-04 14:48:43 -07:00
futex_compat.c	ptrace: use fsuid, fsgid, effective creds for fs access checks	2016-02-25 12:01:16 -08:00
groups.c
hung_task.c
irq_work.c	treewide: Remove old email address	2015-11-23 09:44:58 +01:00
jump_label.c	treewide: Remove old email address	2015-11-23 09:44:58 +01:00
kallsyms.c
kcmp.c	ptrace: use fsuid, fsgid, effective creds for fs access checks	2016-02-25 12:01:16 -08:00
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kexec.c	kexec: use file name as the output message prefix	2015-11-06 17:50:42 -08:00
kexec_core.c	kexec: use file name as the output message prefix	2015-11-06 17:50:42 -08:00
kexec_file.c	kexec: use file name as the output message prefix	2015-11-06 17:50:42 -08:00
kexec_internal.h	kexec: split kexec_file syscall code to kexec_file.c	2015-09-10 13:29:01 -07:00
kmod.c	kmod: don't run async usermode helper as a child of kworker thread	2015-10-23 17:55:10 +09:00
kprobes.c	perf/x86/hw_breakpoints: Disallow kernel breakpoints unless kprobe-safe	2015-08-04 10:16:54 +02:00
ksysfs.c	kexec: split kexec_load syscall from kexec core code	2015-09-10 13:29:01 -07:00
kthread.c	kernel/kthread.c:kthread_create_on_node(): clarify documentation	2015-09-04 16:54:41 -07:00
latencytop.c
Makefile	sys_membarrier(): system-wide memory barrier (generic, x86)	2015-09-11 15:21:34 -07:00
membarrier.c	sys_membarrier(): system-wide memory barrier (generic, x86)	2015-09-11 15:21:34 -07:00
memremap.c	devm_memremap: Fix error value when memremap failed	2016-03-03 15:07:08 -08:00
module-internal.h
module.c	modules: fix longstanding /proc/kallsyms vs module insertion race.	2016-03-09 15:34:56 -08:00
module_signing.c	KEYS: Merge the type-specific data with the payload data	2015-10-21 15:18:36 +01:00
notifier.c	Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2015-09-01 08:40:25 -07:00
nsproxy.c
padata.c
panic.c	printk: do cond_resched() between lines while outputting to consoles	2016-02-17 12:30:57 -08:00
params.c	Nothing exciting, minor tweaks and cleanups.	2015-11-09 15:53:39 -08:00
pid.c	pidns: fix NULL dereference in __task_pid_nr_ns()	2015-11-24 12:03:55 -08:00
pid_namespace.c
profile.c	mm: rename alloc_pages_exact_node() to __alloc_pages_node()	2015-09-08 15:35:28 -07:00
ptrace.c	ptrace: use fsuid, fsgid, effective creds for fs access checks	2016-02-25 12:01:16 -08:00
range.c
reboot.c	kexec: split kexec_load syscall from kexec core code	2015-09-10 13:29:01 -07:00
relay.c
resource.c	kernel/resource.c: fix muxed resource handling in __request_region()	2016-03-03 15:07:29 -08:00
seccomp.c	seccomp: always propagate NO_NEW_PRIVS on tsync	2016-03-03 15:07:25 -08:00
signal.c	kernel/signal.c: unexport sigsuspend()	2015-11-20 16:17:32 -08:00
smp.c	mm, page_alloc: distinguish between being unable to sleep, unwilling to sleep and avoiding waking kswapd	2015-11-06 17:50:42 -08:00
smpboot.c	stop_machine: Kill smp_hotplug_thread->pre_unpark, introduce stop_machine_unpark()	2015-10-20 10:23:55 +02:00
smpboot.h
softirq.c
stacktrace.c
stop_machine.c	kernel: remove stop_machine() Kconfig dependency	2015-12-12 10:15:34 -08:00
sys.c	prctl: take mmap sem for writing to protect against others	2016-02-25 12:01:25 -08:00
sys_ni.c	mm: mlock: add new mlock system call	2015-11-05 19:34:48 -08:00
sysctl.c	pipe: limit the per-user amount of pages allocated in pipes	2016-06-07 18:14:35 -07:00
sysctl_binary.c	fs/coredump: prevent fsuid=0 dumps into user-controlled directories	2016-04-12 09:08:58 -07:00
task_work.c	task_work: remove fifo ordering guarantee	2015-09-05 13:46:58 -07:00
taskstats.c
test_kprobes.c
torture.c	torture: Consolidate cond_resched_rcu_qs() into stutter_wait()	2015-10-06 11:25:01 -07:00
tracepoint.c	tracepoint: Give priority to probes of tracepoints	2015-10-25 21:33:54 -04:00
tsacct.c
uid16.c
up.c
user-return-notifier.c
user.c
user_namespace.c	capabilities: ambient capabilities	2015-09-04 16:54:41 -07:00
utsname.c
utsname_sysctl.c
watchdog.c	watchdog: don't run proc_watchdog_update if new value is same as old	2016-04-12 09:08:54 -07:00
workqueue.c	workqueue: fix rebind bound workers warning	2016-05-18 17:06:50 -07:00
workqueue_internal.h