Willy Tarreau fa6d0ba12a pipe: limit the per-user amount of pages allocated in pipes ... commit 759c01142a upstream. On no-so-small systems, it is possible for a single process to cause an OOM condition by filling large pipes with data that are never read. A typical process filling 4000 pipes with 1 MB of data will use 4 GB of memory. On small systems it may be tricky to set the pipe max size to prevent this from happening. This patch makes it possible to enforce a per-user soft limit above which new pipes will be limited to a single page, effectively limiting them to 4 kB each, as well as a hard limit above which no new pipes may be created for this user. This has the effect of protecting the system against memory abuse without hurting other users, and still allowing pipes to work correctly though with less data at once. The limit are controlled by two new sysctls : pipe-user-pages-soft, and pipe-user-pages-hard. Both may be disabled by setting them to zero. The default soft limit allows the default number of FDs per process (1024) to create pipes of the default size (64kB), thus reaching a limit of 64MB before starting to create only smaller pipes. With 256 processes limited to 1024 FDs each, this results in 1024*64kB + (256*1024 - 1024) * 4kB = 1084 MB of memory allocated for a user. The hard limit is disabled by default to avoid breaking existing applications that make intensive use of pipes (eg: for splicing). Reported-by: socketpair@gmail.com Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Mitigates: CVE-2013-4312 (Linux 2.0+) Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Willy Tarreau <w@1wt.eu> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Cc: Moritz Muehlenhoff <moritz@wikimedia.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2016-06-07 18:14:35 -07:00
..
acpi	Merge branch 'acpi-pci'	2015-11-07 01:30:10 +01:00
asm-generic	SIGNAL: Move generic copy_siginfo() to signal.h	2016-06-01 12:15:54 -07:00
clocksource
crypto	crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey path	2016-02-17 12:31:03 -08:00
drm	drm: Loongson-3 doesn't fully support wc memory	2016-05-04 14:48:46 -07:00
dt-bindings	ARM: DT updates for v4.4	2015-11-10 15:06:26 -08:00
keys	KEYS: Merge the type-specific data with the payload data	2015-10-21 15:18:36 +01:00
kvm	KVM: arm/arm64: arch_timer: Preserve physical dist. active state on LR.active	2015-11-24 18:07:40 +01:00
linux	pipe: limit the per-user amount of pages allocated in pipes	2016-06-07 18:14:35 -07:00
math-emu
media	videobuf2-core: Check user space planes array in dqbuf	2016-05-04 14:48:50 -07:00
memory
misc
net	net_sched: update hierarchical backlog too	2016-05-18 17:06:39 -07:00
pcmcia
ras
rdma	IB/security: Restrict use of the write() interface	2016-05-04 14:48:48 -07:00
rxrpc
scsi	scsi: Add intermediate STARGET_REMOVE state to scsi_target_state	2016-06-01 12:15:54 -07:00
soc	ARM: SoC driver updates for v4.4	2015-11-10 15:00:03 -08:00
sound	ALSA: rawmidi: Make snd_rawmidi_transmit() race-free	2016-02-17 12:30:58 -08:00
target	target: Fix WRITE_SAME/DISCARD conversion to linux 512b sectors	2016-03-09 15:34:51 -08:00
trace	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux	2015-11-11 09:03:01 -08:00
uapi	uapi glibc compat: fix compile errors when glibc net/if.h included before linux/if.h MIME-Version: 1.0	2016-05-18 17:06:43 -07:00
video	gpu: ipu-v3: drop unused dmfc field from client platform data	2015-11-24 11:30:15 +01:00
xen	xen: Fix page <-> pfn conversion on 32 bit systems	2016-05-11 11:21:14 +02:00
Kbuild