[PATCH, RFC] mm: Implement RLIMIT_RSS

[PATCH, RFC] mm: Implement RLIMIT_RSS

[Jörn Engel]

I've seen a couple of instances where people try to impose a vsize
limit simply because there is no rss limit in Linux.  The vsize limit
is a horrible approximation and even this patch seems to be an
improvement.

Would there be strong opposition to actually supporting RLIMIT_RSS?

JA?rn

--
It's not whether you win or lose, it's how you place the blame.
-- unknown


Not quite perfect, but close enough for many purposes.  This checks rss
limit inside may_expand_vm() and will fail if we are already over the
limit.

Signed-off-by: Joern Engel <joern@logfs.org>
---
 mm/mmap.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/mm/mmap.c b/mm/mmap.c
index ab652fa..ea90c73 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2446,12 +2446,19 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
 int may_expand_vm(struct mm_struct *mm, unsigned long npages)
 {
 	unsigned long cur = mm->total_vm;	/* pages */
-	unsigned long lim;
+	unsigned long lim, rlim;
 
 	lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
+	rlim = rlimit(RLIMIT_RSS) >> PAGE_SHIFT;
 
 	if (cur + npages > lim)
 		return 0;
+	if (cur + npages > rlim) {
+		/* Yes, the rss limit is somewhat imprecise. */
+		if (get_mm_rss(mm) > rlim) {
+			return 0;
+		}
+	}
 	return 1;
 }
 
-- 
1.7.10.4

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

[PATCH, RFC] mm: Implement RLIMIT_RSS

[Jörn Engel]

I've seen a couple of instances where people try to impose a vsize
limit simply because there is no rss limit in Linux.  The vsize limit
is a horrible approximation and even this patch seems to be an
improvement.

Would there be strong opposition to actually supporting RLIMIT_RSS?

Jörn

--
It's not whether you win or lose, it's how you place the blame.
-- unknown


Not quite perfect, but close enough for many purposes.  This checks rss
limit inside may_expand_vm() and will fail if we are already over the
limit.

Signed-off-by: Joern Engel <joern@logfs.org>
---
 mm/mmap.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/mm/mmap.c b/mm/mmap.c
index ab652fa..ea90c73 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2446,12 +2446,19 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
 int may_expand_vm(struct mm_struct *mm, unsigned long npages)
 {
 	unsigned long cur = mm->total_vm;	/* pages */
-	unsigned long lim;
+	unsigned long lim, rlim;
 
 	lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
+	rlim = rlimit(RLIMIT_RSS) >> PAGE_SHIFT;
 
 	if (cur + npages > lim)
 		return 0;
+	if (cur + npages > rlim) {
+		/* Yes, the rss limit is somewhat imprecise. */
+		if (get_mm_rss(mm) > rlim) {
+			return 0;
+		}
+	}
 	return 1;
 }
 
-- 
1.7.10.4

Re: [PATCH, RFC] mm: Implement RLIMIT_RSS

[Johannes Weiner]

On Tue, Jun 11, 2013 at 02:29:21PM -0400, Jorn Engel wrote:
> I've seen a couple of instances where people try to impose a vsize
> limit simply because there is no rss limit in Linux.  The vsize limit
> is a horrible approximation and even this patch seems to be an
> improvement.
> 
> Would there be strong opposition to actually supporting RLIMIT_RSS?
> 
> Jorn
> 
> --
> It's not whether you win or lose, it's how you place the blame.
> -- unknown
> 
> 
> Not quite perfect, but close enough for many purposes.  This checks rss
> limit inside may_expand_vm() and will fail if we are already over the
> limit.

This is trivial to exploit by creating the mappings first and
populating them later, so while it may cover some use cases, it does
not have the protection against malicious programs aspect that all the
other rlimits have.

The right place to enforce the limit is at the point of memory
allocation, which raises the question what to do when the limit is
exceeded in a page fault.  Reclaim from the process's memory?  Kill
it?

I guess the answer to these questions is "memory cgroups", so that's
why there is no real motivation to implement RLIMIT_RSS separately...

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [PATCH, RFC] mm: Implement RLIMIT_RSS

[Johannes Weiner]

On Tue, Jun 11, 2013 at 02:29:21PM -0400, Jörn Engel wrote:
> I've seen a couple of instances where people try to impose a vsize
> limit simply because there is no rss limit in Linux.  The vsize limit
> is a horrible approximation and even this patch seems to be an
> improvement.
> 
> Would there be strong opposition to actually supporting RLIMIT_RSS?
> 
> Jörn
> 
> --
> It's not whether you win or lose, it's how you place the blame.
> -- unknown
> 
> 
> Not quite perfect, but close enough for many purposes.  This checks rss
> limit inside may_expand_vm() and will fail if we are already over the
> limit.

This is trivial to exploit by creating the mappings first and
populating them later, so while it may cover some use cases, it does
not have the protection against malicious programs aspect that all the
other rlimits have.

The right place to enforce the limit is at the point of memory
allocation, which raises the question what to do when the limit is
exceeded in a page fault.  Reclaim from the process's memory?  Kill
it?

I guess the answer to these questions is "memory cgroups", so that's
why there is no real motivation to implement RLIMIT_RSS separately...

Re: [PATCH, RFC] mm: Implement RLIMIT_RSS

[Jörn Engel]

On Tue, 11 June 2013 17:16:01 -0400, Johannes Weiner wrote:
> On Tue, Jun 11, 2013 at 02:29:21PM -0400, JA?rn Engel wrote:
> > I've seen a couple of instances where people try to impose a vsize
> > limit simply because there is no rss limit in Linux.  The vsize limit
> > is a horrible approximation and even this patch seems to be an
> > improvement.
> > 
> > Would there be strong opposition to actually supporting RLIMIT_RSS?
> 
> This is trivial to exploit by creating the mappings first and
> populating them later, so while it may cover some use cases, it does
> not have the protection against malicious programs aspect that all the
> other rlimits have.

Hm.  The use case I have is that an application wants to limit itself.
It is effectively a special assert to catch memory leaks and the like.
So malicious programs are not my immediate concern.

Of course the moment Linux supports RLIMIT_RSS people will use it to
limit malicious programs, no matter how many scary warning we put in.

> The right place to enforce the limit is at the point of memory
> allocation, which raises the question what to do when the limit is
> exceeded in a page fault.  Reclaim from the process's memory?  Kill
> it?
> 
> I guess the answer to these questions is "memory cgroups", so that's
> why there is no real motivation to implement RLIMIT_RSS separately...

Lack of opposition would be enough for me.  But I guess we need a bit
more for a mergeable patch than I did and I only did the existing
patch because it seemed easy, not because it is important.  Will keep
the patch in my junk code folder for now.

JA?rn

--
A surrounded army must be given a way out.
-- Sun Tzu

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [PATCH, RFC] mm: Implement RLIMIT_RSS

[Jörn Engel]

On Tue, 11 June 2013 17:16:01 -0400, Johannes Weiner wrote:
> On Tue, Jun 11, 2013 at 02:29:21PM -0400, Jörn Engel wrote:
> > I've seen a couple of instances where people try to impose a vsize
> > limit simply because there is no rss limit in Linux.  The vsize limit
> > is a horrible approximation and even this patch seems to be an
> > improvement.
> > 
> > Would there be strong opposition to actually supporting RLIMIT_RSS?
> 
> This is trivial to exploit by creating the mappings first and
> populating them later, so while it may cover some use cases, it does
> not have the protection against malicious programs aspect that all the
> other rlimits have.

Hm.  The use case I have is that an application wants to limit itself.
It is effectively a special assert to catch memory leaks and the like.
So malicious programs are not my immediate concern.

Of course the moment Linux supports RLIMIT_RSS people will use it to
limit malicious programs, no matter how many scary warning we put in.

> The right place to enforce the limit is at the point of memory
> allocation, which raises the question what to do when the limit is
> exceeded in a page fault.  Reclaim from the process's memory?  Kill
> it?
> 
> I guess the answer to these questions is "memory cgroups", so that's
> why there is no real motivation to implement RLIMIT_RSS separately...

Lack of opposition would be enough for me.  But I guess we need a bit
more for a mergeable patch than I did and I only did the existing
patch because it seemed easy, not because it is important.  Will keep
the patch in my junk code folder for now.

Jörn

--
A surrounded army must be given a way out.
-- Sun Tzu

Re: [PATCH, RFC] mm: Implement RLIMIT_RSS

[Minchan Kim]

Hey Jorn,

On Tue, Jun 11, 2013 at 05:53:20PM -0400, Jorn Engel wrote:
> On Tue, 11 June 2013 17:16:01 -0400, Johannes Weiner wrote:
> > On Tue, Jun 11, 2013 at 02:29:21PM -0400, Jorn Engel wrote:
> > > I've seen a couple of instances where people try to impose a vsize
> > > limit simply because there is no rss limit in Linux.  The vsize limit
> > > is a horrible approximation and even this patch seems to be an
> > > improvement.
> > > 
> > > Would there be strong opposition to actually supporting RLIMIT_RSS?
> > 
> > This is trivial to exploit by creating the mappings first and
> > populating them later, so while it may cover some use cases, it does
> > not have the protection against malicious programs aspect that all the
> > other rlimits have.
> 
> Hm.  The use case I have is that an application wants to limit itself.
> It is effectively a special assert to catch memory leaks and the like.
> So malicious programs are not my immediate concern.

Just out of curisoity.

It means you already know the max rss of the application in advance
so you can use taskstats's hiwater_rss if you don't need to catch
the moment which rss is over the limit.

-- 
Kind regards,
Minchan Kim

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [PATCH, RFC] mm: Implement RLIMIT_RSS

[Minchan Kim]

Hey Jörn,

On Tue, Jun 11, 2013 at 05:53:20PM -0400, Jörn Engel wrote:
> On Tue, 11 June 2013 17:16:01 -0400, Johannes Weiner wrote:
> > On Tue, Jun 11, 2013 at 02:29:21PM -0400, Jörn Engel wrote:
> > > I've seen a couple of instances where people try to impose a vsize
> > > limit simply because there is no rss limit in Linux.  The vsize limit
> > > is a horrible approximation and even this patch seems to be an
> > > improvement.
> > > 
> > > Would there be strong opposition to actually supporting RLIMIT_RSS?
> > 
> > This is trivial to exploit by creating the mappings first and
> > populating them later, so while it may cover some use cases, it does
> > not have the protection against malicious programs aspect that all the
> > other rlimits have.
> 
> Hm.  The use case I have is that an application wants to limit itself.
> It is effectively a special assert to catch memory leaks and the like.
> So malicious programs are not my immediate concern.

Just out of curisoity.

It means you already know the max rss of the application in advance
so you can use taskstats's hiwater_rss if you don't need to catch
the moment which rss is over the limit.

-- 
Kind regards,
Minchan Kim

Re: [PATCH, RFC] mm: Implement RLIMIT_RSS

[Jörn Engel]

On Thu, 13 June 2013 17:57:32 +0900, Minchan Kim wrote:
> 
> It means you already know the max rss of the application in advance
> so you can use taskstats's hiwater_rss if you don't need to catch
> the moment which rss is over the limit.

I would like to catch the very moment.  Just for my particular needs,
it doesn't matter much if you overshoot by 10% or so.  But eventually
I would like a patch that is off by less than 1% and low-overhead at
the same time.

JA?rn

--
Measuring programming progress by lines of code is like measuring aircraft
building progress by weight.
-- Bill Gates

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [PATCH, RFC] mm: Implement RLIMIT_RSS

[Jörn Engel]

On Thu, 13 June 2013 17:57:32 +0900, Minchan Kim wrote:
> 
> It means you already know the max rss of the application in advance
> so you can use taskstats's hiwater_rss if you don't need to catch
> the moment which rss is over the limit.

I would like to catch the very moment.  Just for my particular needs,
it doesn't matter much if you overshoot by 10% or so.  But eventually
I would like a patch that is off by less than 1% and low-overhead at
the same time.

Jörn

--
Measuring programming progress by lines of code is like measuring aircraft
building progress by weight.
-- Bill Gates