On Mon, 17 Jun 2013 12:58:00 -0700 ebiederm@xxxxxxxxxxxx (Eric W. Biederman) wrote: > > I found that a few processes can eat all host memory and nobody can kill them. > > $ mount -t tmpfs xxx /mnt > > $ mount --make-shared /mnt > > $ for i in `seq 30`; do mount --bind /mnt `mktemp -d /mnt/test.XXXXXX` & done > > > > All this processes are unkillable, because they took i_mutex and waits > > namespace_lock. > > > > ... > > 21715 pts/0 ______D __________0:00 __________________\_ mount --bind /mnt /mnt/test.ht6jzO > > 21716 pts/0 ______D __________0:00 __________________\_ mount --bind /mnt /mnt/test.97K4mI > > 21717 pts/0 ______R __________0:01 __________________\_ mount --bind /mnt /mnt/test.gO2CD9 > > ... > > > > Each of this process doubles a number of mounts, so at the end we will > > have about 2^32 mounts and the size of struct mnt is 256 bytes, so we > > need about 1TB of RAM. > > > > Another problem is that ___umount___ of a big tree is very hard operation > > and it requires a lot of time. > > E.g.: > > 16411 > > umount("/tmp/xxx", MNT_DETACH) __________________= 0 <7.852066> (7.8 sec) > > 32795 > > umount("/tmp/xxx", MNT_DETACH) __________________= 0 <34.485501> ( 34 sec) > > > > For all this time sys_umoun takes namespace_sem and vfsmount_lock... > > > > Due to all this reasons I suggest to restrict a number of mounts. > > Probably we can optimize this code in a future, but now this restriction > > can help. > > So for anyone seriously worried about this kind of thing in general we > already have the memory control group, which is quite capable of > limiting this kind of thing, and it limits all memory allocations not > just mount. What is the exposure here? By what means can a non-CAP_SYS_ADMIN user run sys_mount() under the namespace system? IOW, what does the sysadmin have to do to permit this? Is that a typical thing to do, or did the sysadmin make a mistake? -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html