Hi Kirill, On Sat, Dec 29, 2018 at 1:52 AM Kirill Tkhai <ktkhai@xxxxxxxxxxxxx> wrote: > > Hi, Michal! > > On 29.12.2018 10:33, Michal Hocko wrote: > > On Fri 28-12-18 17:55:24, Shakeel Butt wrote: > >> The [ip,ip6,arp]_tables use x_tables_info internally and the underlying > >> memory is already accounted to kmemcg. Do the same for ebtables. The > >> syzbot, by using setsockopt(EBT_SO_SET_ENTRIES), was able to OOM the > >> whole system from a restricted memcg, a potential DoS. > > > > What is the lifetime of these objects? Are they bound to any process? > > These are list of ebtables rules, which may be displayed with $ebtables-save command. > In case of we do not account them, a low priority container may eat all the memory > and OOM killer in berserk mode will kill all the processes on machine. They are not bound > to any process, but they are bound to network namespace. > > OOM killer does not analyze such the memory cgroup-related allocations, since it > is task-aware only. Maybe we should do it namespace-aware too... This is a good idea. I am already brainstorming on a somewhat similar idea to make shmem/tmpfs files oom-killable. I will share once I have something more concrete and will think on namespace angle too. thanks, Shakeel
