On Mon, 13 Jan 2025 at 22:44, Jeff Layton <jlayton@xxxxxxxxxx> wrote: > What if we were to allow the kernel to kill off an unprivileged FUSE > server that was "misbehaving" [1], clean any dirty pagecache pages that > it has, and set writeback errors on the corresponding FUSE inodes [2]? > We'd still need a rather long timeout (on the order of at least a > minute or so, by default). How would this be different from Joanne's current request timeout patch? I think it makes sense, but it *has* to be opt in, for the same reason that NFS soft timeout is opt in, so it can't really solve the page migration issue generally. Also page reading has exactly the same issues, so fixing writeback is not enough. Maybe an explicit callback from the migration code to the filesystem would work. I.e. move the complexity of dealing with migration for problematic filesystems (netfs/fuse) to the filesystem itself. I'm not sure how this would actually look, as I'm unfamiliar with the details of page migration, but I guess it shouldn't be too difficult to implement for fuse at least. Thanks, Miklos > > Would that be enough to assuage concerns about unprivileged servers > pinning pages indefinitely? Buggy servers are still a problem, but > there's not much we can do about that. > > There are a lot of details we'd have to sort out, so I'm also > interested in whether anyone (Miklos? Bernd?) would find this basic > approach objectionable. > > [1]: for some definition of misbehavior. Probably a writeback > timeout of some sort but maybe there would be other criteria too. > > [2]: or maybe just make them eligible to be cleaned without talking to > the server, should the VM wish it. > -- > Jeff Layton <jlayton@xxxxxxxxxx>
