* [Devel] [PATCH hci-8.1 0/2] ve/fs: allow host to go over container mount limit
@ 2026-09-28 15:24 Pavel Tikhomirov
2026-09-28 15:24 ` [Devel] [PATCH hci-8.1 1/2] ve/fs: allow host to go over limit of container mount namespace Pavel Tikhomirov
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: Pavel Tikhomirov @ 2026-09-28 15:24 UTC (permalink / raw)
To: Konstantin Khorenko, Vladimir Riabchun, Vasileios Almpanis; +Cc: devel
Since 22.4 CRIU fails to dump a container which is close to its mount
limit:
Error (criu/mount.c:1740): mnt: Unable to unshare a mount namespace: Cannot allocate memory
To get access to overmounted mounts, CRIU (in ve0) copies the container
mount namespace. The copied mounts are owned by and charged to the
container, and now the container limit is also checked for them, so the
host is restricted by the container limit.
Patch 1 relaxes the limit for ve0 (still counting, as for pseudosuper),
patch 2 adds a selftest for it.
https://virtuozzo.atlassian.net/browse/VSTOR-147661
Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
---
Pavel Tikhomirov (2):
ve/fs: allow host to go over limit of container mount namespace
selftests/ve: check that host can go over container mount limit
fs/namespace.c | 3 +-
.../selftests/ve/ve_mount_accounting_test.c | 37 ++++++++++++++++++++++
2 files changed, 39 insertions(+), 1 deletion(-)
---
base-commit: ca54f152160587a74ff17cb52feef16f7b9d4e2b
change-id: 20260928-b4-ve0-mnt-limit-5bdc176203a4
Best regards,
--
Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel
^ permalink raw reply [flat|nested] 5+ messages in thread* [Devel] [PATCH hci-8.1 1/2] ve/fs: allow host to go over limit of container mount namespace 2026-09-28 15:24 [Devel] [PATCH hci-8.1 0/2] ve/fs: allow host to go over container mount limit Pavel Tikhomirov @ 2026-09-28 15:24 ` Pavel Tikhomirov 2026-09-28 15:24 ` [Devel] [PATCH hci-8.1 2/2] selftests/ve: check that host can go over container mount limit Pavel Tikhomirov ` (2 subsequent siblings) 3 siblings, 0 replies; 5+ messages in thread From: Pavel Tikhomirov @ 2026-09-28 15:24 UTC (permalink / raw) To: Konstantin Khorenko, Vladimir Riabchun, Vasileios Almpanis; +Cc: devel This is something that CRIU does on dump, to get access to some mounts (under overmounts) we have to have a copy of namespace where we can try umounting stuff which covers the path. Together [1] + [2] lead to those mounts been accounted to ve and not allowed to go over the limit leading to CRIU fail. Let's relax it back. [1] commit c53e7bc5f513 ("ve/fs: take the owner of copied mounts from the namespace, not the task") https://virtuozzo.atlassian.net/browse/VSTOR-147661 Feature: per-ve failcounters Fixes: b9c2e2d6ee85 ("ve/fs: count available mounts instead of used ones") [2] Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> --- fs/namespace.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/namespace.c b/fs/namespace.c index cf77c3fb98407..75cabf7763ef6 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -3367,7 +3367,8 @@ int ve_devmnt_verify(struct ve_struct *ve, dev_t dev, char *opts, bool new_mount static inline int ve_try_reserve_mount(struct ve_struct *ve) { - int ret = ve_is_super(ve) || ve->is_pseudosuper; + int ret = ve_is_super(ve) || ve->is_pseudosuper || + ve_is_super(get_exec_env()); /* Ignore limits in ve0 and pseudosuper cases, but still count. */ if (ret) atomic_dec(&ve->mnt_avail_nr); -- 2.55.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel ^ permalink raw reply [flat|nested] 5+ messages in thread
* [Devel] [PATCH hci-8.1 2/2] selftests/ve: check that host can go over container mount limit 2026-09-28 15:24 [Devel] [PATCH hci-8.1 0/2] ve/fs: allow host to go over container mount limit Pavel Tikhomirov 2026-09-28 15:24 ` [Devel] [PATCH hci-8.1 1/2] ve/fs: allow host to go over limit of container mount namespace Pavel Tikhomirov @ 2026-09-28 15:24 ` Pavel Tikhomirov 2026-09-30 15:05 ` [Devel] [PATCH hci-8.1 0/2] ve/fs: allow host to " Konstantin Khorenko 2026-09-30 15:09 ` Konstantin Khorenko 3 siblings, 0 replies; 5+ messages in thread From: Pavel Tikhomirov @ 2026-09-28 15:24 UTC (permalink / raw) To: Konstantin Khorenko, Vladimir Riabchun, Vasileios Almpanis; +Cc: devel Like pseudosuper_allows_overuse, check that a bind mount done from ve0 in the container mount namespace succeeds when the container has no mounts left, and is charged to the container. https://virtuozzo.atlassian.net/browse/VSTOR-147661 Feature: per-ve failcounters Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> --- .../selftests/ve/ve_mount_accounting_test.c | 37 ++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/tools/testing/selftests/ve/ve_mount_accounting_test.c b/tools/testing/selftests/ve/ve_mount_accounting_test.c index e2a882137e11d..8bb13e9615427 100644 --- a/tools/testing/selftests/ve/ve_mount_accounting_test.c +++ b/tools/testing/selftests/ve/ve_mount_accounting_test.c @@ -539,6 +539,43 @@ TEST_F(ve_mnt_acc, failcount) ASSERT_TRUE(strstr(failcount_str, "mnt: 1\n") != NULL); } +static int _create_bind_mount(void *id_ptr) +{ + char path[PATH_MAX]; + int id = *(int *)id_ptr; + + snprintf(path, sizeof(path), TMP_DIR "%d", id); + + if (mkdir(path, 0755) < 0) { + fprintf(stderr, "Failed to create directory %s: %s\n", path, strerror(errno)); + return -1; + } + if (!mount(path, path, NULL, MS_BIND, NULL)) + return 0; + fprintf(stderr, "Failed to bind mount %s: %s\n", path, strerror(errno)); + + rmdir(path); + return -1; +} + +/* Test that host can go over the limit in container mount namespace. */ +TEST_F(ve_mnt_acc, host_allows_overuse) +{ + char path_max_nr[64]; + int id = 0; + + snprintf(path_max_nr, sizeof(path_max_nr), "%d/ve.mnt_max_nr", self->ctid); + + ASSERT_EQ(write_u64_at(self->cgv2_fd, path_max_nr, self->orig_have_mnt), 0); + + /* Bind mount from ve0, charged to the container's mount namespace owner */ + ASSERT_EQ(run_in_ve(self->cgv2_fd, self->ctid, &self->ns_ctx, + CLONE_NEWNS, _create_bind_mount, &id), 0); + ASSERT_EQ(wait_on_mnt_avail(self, -1), 0); + + ASSERT_EQ(destroy_mount(self, 0), 0); +} + int main(int argc, char **argv) { need_avail = mmap(NULL, sizeof(int), -- 2.55.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Devel] [PATCH hci-8.1 0/2] ve/fs: allow host to go over container mount limit 2026-09-28 15:24 [Devel] [PATCH hci-8.1 0/2] ve/fs: allow host to go over container mount limit Pavel Tikhomirov 2026-09-28 15:24 ` [Devel] [PATCH hci-8.1 1/2] ve/fs: allow host to go over limit of container mount namespace Pavel Tikhomirov 2026-09-28 15:24 ` [Devel] [PATCH hci-8.1 2/2] selftests/ve: check that host can go over container mount limit Pavel Tikhomirov @ 2026-09-30 15:05 ` Konstantin Khorenko 2026-09-30 15:09 ` Konstantin Khorenko 3 siblings, 0 replies; 5+ messages in thread From: Konstantin Khorenko @ 2026-09-30 15:05 UTC (permalink / raw) To: Pavel Tikhomirov; +Cc: devel On Mon, 28 Sep 2026 17:24:56 +0200, Pavel Tikhomirov <ptikhomirov@virtuozzo.com> wrote: > ve/fs: allow host to go over container mount limit > > Since 22.4 CRIU fails to dump a container which is close to its mount > limit: > > Error (criu/mount.c:1740): mnt: Unable to unshare a mount namespace: Cannot allocate memory > > [...] Reviewed-by: Konstantin Khorenko <khorenko@virtuozzo.com> -- Konstantin Khorenko <khorenko@virtuozzo.com> _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Devel] [PATCH hci-8.1 0/2] ve/fs: allow host to go over container mount limit 2026-09-28 15:24 [Devel] [PATCH hci-8.1 0/2] ve/fs: allow host to go over container mount limit Pavel Tikhomirov ` (2 preceding siblings ...) 2026-09-30 15:05 ` [Devel] [PATCH hci-8.1 0/2] ve/fs: allow host to " Konstantin Khorenko @ 2026-09-30 15:09 ` Konstantin Khorenko 3 siblings, 0 replies; 5+ messages in thread From: Konstantin Khorenko @ 2026-09-30 15:09 UTC (permalink / raw) To: Vladimir Riabchun, Vasileios Almpanis, Pavel Tikhomirov; +Cc: devel On Mon, 28 Sep 2026 17:24:56 +0200, Pavel Tikhomirov wrote: > ve/fs: allow host to go over container mount limit > > Since 22.4 CRIU fails to dump a container which is close to its mount > limit: > > Error (criu/mount.c:1740): mnt: Unable to unshare a mount namespace: Cannot allocate memory > > [...] Applied to branch-rh10-6.12.0-211.52.1.22.x.vz10-ovz, will be released in rh10-6.12.0-211.52.1.22.5.vz10, thanks! [1/2] ve/fs: allow host to go over limit of container mount namespace https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/e6358d78bde7 [2/2] selftests/ve: check that host can go over container mount limit https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/95abfad2aff6 -- Konstantin Khorenko <khorenko@virtuozzo.com> _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-09-30 15:11 UTC | newest] Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2026-09-28 15:24 [Devel] [PATCH hci-8.1 0/2] ve/fs: allow host to go over container mount limit Pavel Tikhomirov 2026-09-28 15:24 ` [Devel] [PATCH hci-8.1 1/2] ve/fs: allow host to go over limit of container mount namespace Pavel Tikhomirov 2026-09-28 15:24 ` [Devel] [PATCH hci-8.1 2/2] selftests/ve: check that host can go over container mount limit Pavel Tikhomirov 2026-09-30 15:05 ` [Devel] [PATCH hci-8.1 0/2] ve/fs: allow host to " Konstantin Khorenko 2026-09-30 15:09 ` Konstantin Khorenko
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.