From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 76D7B8015B for ; Fri, 25 Sep 2026 16:54:59 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68PGrjtK027387; Fri, 25 Sep 2026 19:53:46 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68PGrjtK027387 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="YjnlrL5v" Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68PGrbMQ027334 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Fri, 25 Sep 2026 19:53:37 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68PGrbMQ027334 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-4887efa4486so669237f8f.1 for ; Fri, 25 Sep 2026 09:53:37 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBwCoeCsxqJL8hVMigxWLqvHol5gpnSuB6TXw/R364n2PRm2Ic5dsltScvvUmnDL6dXWqCndhw==@openvz.org X-Gm-Message-State: AFuF++ksPxg/blMz+9GB47BbI/bv4ZWrCS7HU/stBtlSYixNJ5kL/xdD NsYZSVmmdzheSwyck9BR6dXgm6frb+h/iph+sOgEOhGibcYjgDAXFDToMcdjYedu8WMXYgoT3Md Eo5VNZTWBYdWoufhku5aM4z9jXDCDW1B5BS8IUDvwjWRLOPnM6Q4K6Q== X-Gm-Gg: AYBFou2OMe+snNtkMhUxX3vECQnX51WVAFTMyPsyHaA2PdKzf+MKnde3Ay63S5EflXt CZO8+MzDT978P4TSur+27qLS7mLjGqP20lhL5YjRYNn+LEBeXnaWrgQYTE34nSLlOQ1pI4xuO9+ 56rlwhrPdaHfbq/Zu8z+PyFbvFkZGEznhphFIFEiwfYqCz+rysSKJIs7YuX4HU1kCtyuBYWmOeN n/MrWFV8kWsBVaHjIxCGfN0ljijkEmgxcAOIGbjNnU5PpfskbVx5jF8Tvysv3M8lAgW6Lk6Mf2g 1VT1SDyfXCUMj/X6w4kPooQVYFWc4J3vRnX66FRPfEd+HPiyGvv66/dKcVF7CSNL2knjs3bSBv6 /ym+vA1l9na4InP1YKA== X-Received: by 2002:a05:6000:290e:b0:487:27f9:837 with SMTP id ffacd0b85a97d-4887170f426mr11915056f8f.44.1790355217275; Fri, 25 Sep 2026 09:53:37 -0700 (PDT) X-Received: by 2002:a05:6000:290e:b0:487:27f9:837 with SMTP id ffacd0b85a97d-4887170f426mr11915013f8f.44.1790355216613; Fri, 25 Sep 2026 09:53:36 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1790355216; cv=none; d=google.com; s=arc-20260327; b=a/jQx/PEaJF9bKdbAFsdpaVIeME45Zbr2zQw0PjzgOIbF9ffv+3DaZsKf6ycP3AnU0 CUAX3z3dddmda5M0Q9hhpdV+dtgqIBah0nphz3pbEgRXv9V0VMXbHZGpgjAq1N+6PZEm qWwuYbhp0q0L+jjN/1GDqZcoxXbfoQwR44FXZ3VzUHD9A1OdLbiUCvU1EPqX5kV1OVcG fHezZgEE6bXV42z6zfdzkESxmG6hbSS2/FMP5tLSV89xY6sn/eAFxaFF3oHZCoXgOWUd ZfPrmVYVPFHUg10wjR9/7BOahethWqxRP77fVthLQPEeQ6cZETwkjm0p5m3RIygXt7aG dlxQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:dkim-signature; bh=AcHyR7Ibf6ZP8i1UbFUPOPkx7Yif71F0HpXvbB4jnz8=; fh=zK/v/gHQ7GavWYhLJT8+SASJ7h8osfxqNHUzmzGkT+o=; b=aTKTYyy2blo7bTX7JsFPMo90BIMxagh6rbAu7LB3Ea4w5Xv8qMe9fKqnvLl0jm7g8R ZGXjXKZmfbfCTW1o6pjWtzM+42PHmYOa3hMlDL4V8QsvGCCiXf2kOQimUDRAauzxK+O0 pCaMgloNGr5QOoonwM19Bv/h0VdtIcrvhooR8QnTKSphu/F/IOhF6mrH2rl1UPx/PKur i3AxpKWUQtIxzBluFymXHIcv2dkhpsyUdK3aQADqr6lIgsAh6hcEsd1k9w5gBc8j33zQ AZufiLg5DwiapU7/KAakOxJyTmXY0k/SEC5TbUvaTQMSGyf5njXWmve4rF58Y5cZJx9z 7W4Q==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=YjnlrL5v; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-4887a64ccabsi7676110f8f.173.2026.09.25.09.53.36 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Sep 2026 09:53:36 -0700 (PDT) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=YjnlrL5v; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Content-Type:MIME-Version:Subject:Date :From; bh=AcHyR7Ibf6ZP8i1UbFUPOPkx7Yif71F0HpXvbB4jnz8=; b=YjnlrL5vRrjfk2AHWhz DFg0VRCY1xgbbrmwIlBdtVlyq5cORfo3KtIB1A2+Ht0o+cD6eOxqmN4TR7L8wTdHLHjG+pH222A1n aU2K7i3NtxoNWPkLsmjiEphIN7hTOkVi/BtHIitcOR9iNJAWViCEiVXXXYNXQvb2T9OxkJWQCB1/L +juR6j0HVzjEpEjbjfWgQ7GEkY19Crm0+BiS/0QKsIPazmG0EMKwPhLi7fSDqeaMZwh7BQvYBrXnJ H3BL6Eeth0CErE+wdVIGSLqewBFwKC5vYoUAHai1f6oypXfmhxEdaoXjoaaBJcLSqu8GyCpU1R7uz btID2C3xIRe6ULg==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xA984-00CFkL-09; Fri, 25 Sep 2026 18:53:32 +0200 From: Konstantin Khorenko Date: Fri, 25 Sep 2026 18:53:23 +0200 MIME-Version: 1.0 Message-Id: <20260925-b4-kh-ve_fail-v10-2-77a6b6ea4205@virtuozzo.com> References: <20260925-b4-kh-ve_fail-v10-0-77a6b6ea4205@virtuozzo.com> In-Reply-To: <20260925-b4-kh-ve_fail-v10-0-77a6b6ea4205@virtuozzo.com> To: Vasileios Almpanis , Pavel Tikhomirov , cover.1789491989.git.vladimir.riabchun@virtuozzo.com, Konstantin Khorenko , devel@openvz.org X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=8338; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=xvfQl1AaF4cbmHuhm4X11xndzq5p2OUuYs/J3ivWiKI=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBqtqcL1vVqUVVxOzzOzZwEZPkGBjz5+6CFMWS4y NeIVTgjoEaJAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCaranCwAKCRBRlgpH+WFc Kp1HEACb1Zhyx6sxmUrGgD8ENIRLuZABRGom/vsa1CF2aczZ3b7t83nwfZ5Pxp1GoEc5LJ6zRqe VLNZpF4vpGslPFcbxkLNlEurmxM9r2Zi9jI+HRKB2ljrNomM9hQCi31iQl05dngZSuziflhz2kR d9hfN3CAdnvoRfK5rOTAot/msfBZNFpPjLM0LiiNnlOT5SgaQJpciWRAWdR3Nu33j7XRAuoEpqv liWRmKPqX47iTPNrJlCBkoNFMDDpd4GzUUOK2dFVYLd2l5J+LEbr4HTQYVP5fZbUeM4GeGtcf3H 8IqqCWYYFNR9j+YtrUKgnwdVS9ynELvlfMshzCxfR1+GQ10ul07JfZbRzq1CjOdrqmKTzLBx8hN fRoS/aS9CJVbv0q+xiweb2Gp2PPkc2PtVqQxvuJrXuUndGSKS4Mk+N2PZ5LvH9Z4x+/d2uNN0zH LNClAQl9lLTAksZH3VWoFilJCQoFJui7vKSEPONcIurZbZEaJm0gzI8cOXEQn0deh8Ee3cdK8LA eczbpC9EnLDjd7Fd+kAOnIMxCS/0GTh8SvbF3V8RpzuJZEwDxRo2Y03LaLQCuSBnnTWpCRX8BVK wCRy9rLM9iAs8uZU7TeKWu+jZxqwduqBiJZ1Zh5C2OPS8yLLfmDb+KAERQQ1EcR/6sSJrvTjISs NVZv9EP+xusbNDw== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Subject: [Devel] [PATCH hci-8.1 v10 02/13] ve/fs: count available mounts instead of used ones X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org From: Vladimir Riabchun Previous approach with current mounts counter had an issue: there was a gap between ve_mount_allowed check and ve_mount_nr_inc, which could allow CT to have more mounts than expected. Fix this by tracking the number of available mounts instead of current ones. This also makes resources accounting more consistent - we are using ***_avail_nr approach more. One more issue with inconsistent ve value is fixed: ve_mount_allowed always used ve from get_exec_env, but ve_mount_nr_inc operated with owner_ve. Now actual ve value is calculated in the beginning of alloc_vfsmnt. To avoid incorrect accounting when is_pseudosuper is changed, update avail_nr count without > 0 check if VE is ve0 or pseudosuper. This also simplifies ve_mount_put, since increment is now unconditional. https://virtuozzo.atlassian.net/browse/VSTOR-135520 Feature: per-ve failcounters Signed-off-by: Vladimir Riabchun Reviewed-by: Konstantin Khorenko --- fs/namespace.c | 78 ++++++++++++++++++++++++++++++++---------------------- include/linux/ve.h | 2 +- kernel/ve/ve.c | 12 ++++----- 3 files changed, 54 insertions(+), 38 deletions(-) diff --git a/fs/namespace.c b/fs/namespace.c index 4adc1db84b4c0..1d6e66cd71745 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -317,19 +317,22 @@ int mnt_get_count(struct mount *mnt) #endif } -static inline int ve_mount_allowed(void); -static inline void ve_mount_nr_inc(struct mount *mnt, struct ve_struct *ve); -static inline void ve_mount_nr_dec(struct mount *mnt); +static inline int ve_try_reserve_mount(struct ve_struct *ve); +static inline void ve_mount_put(struct mount *mnt, struct ve_struct *ve); static inline void ve_mount_reown(struct mount *mnt, struct ve_struct *ve); static struct mount *alloc_vfsmnt(const char *name, struct ve_struct *owner_ve) { struct mount *mnt; + struct ve_struct *ve = owner_ve; - if (!ve_mount_allowed()) { + if (!ve) + ve = get_exec_env(); + + if (!ve_try_reserve_mount(ve)) { pr_warn_ratelimited( "CT#%s reached the limit on mounts.\n", - ve_name(get_exec_env())); + ve_name(ve)); return NULL; } @@ -337,6 +340,14 @@ static struct mount *alloc_vfsmnt(const char *name, struct ve_struct *owner_ve) if (mnt) { int err; +#ifdef CONFIG_VE + /* + * Got ve reference in ve_try_reserve_mount, set mnt ve data + * here, so in case of error ve_mount_put sees correct info. + */ + mnt->ve_owner = ve; +#endif + err = mnt_alloc_id(mnt); if (err) goto out_free_cache; @@ -371,7 +382,8 @@ static struct mount *alloc_vfsmnt(const char *name, struct ve_struct *owner_ve) INIT_LIST_HEAD(&mnt->mnt_umounting); INIT_HLIST_HEAD(&mnt->mnt_stuck_children); mnt->mnt.mnt_idmap = &nop_mnt_idmap; - ve_mount_nr_inc(mnt, owner_ve); + } else { + ve_mount_put(mnt, ve); } return mnt; @@ -382,6 +394,8 @@ static struct mount *alloc_vfsmnt(const char *name, struct ve_struct *owner_ve) out_free_id: mnt_free_id(mnt); out_free_cache: + /* Got ve reference in ve_try_reserve_mount */ + ve_mount_put(mnt, ve); kmem_cache_free(mnt_cache, mnt); return NULL; } @@ -751,7 +765,9 @@ int sb_prepare_remount_readonly(struct super_block *sb) static void free_vfsmnt(struct mount *mnt) { mnt_idmap_put(mnt_idmap(&mnt->mnt)); - ve_mount_nr_dec(mnt); +#ifdef CONFIG_VE + ve_mount_put(mnt, mnt->ve_owner); +#endif kfree_const(mnt->mnt_devname); #ifdef CONFIG_SMP free_percpu(mnt->mnt_pcp); @@ -3214,7 +3230,7 @@ int ve_devmnt_process(struct ve_struct *ve, dev_t dev, void **data_pp, int remou if (devmnt->dev == dev) { err = ve_devmnt_check(data, devmnt->allowed_options); /* - * In case of @is_pseudouser set, ie restore procedure, + * In case of @is_pseudosuper set, ie restore procedure, * we don't check for allowed options filtering, since * restore mode is special. */ @@ -3353,30 +3369,30 @@ int ve_devmnt_verify(struct ve_struct *ve, dev_t dev, char *opts, bool new_mount return err; } -static inline int ve_mount_allowed(void) -{ - struct ve_struct *ve = get_exec_env(); - - return ve_is_super(ve) || ve->is_pseudosuper || - atomic_read(&ve->mnt_nr) < (int)sysctl_ve_mount_nr; -} - -static inline void ve_mount_nr_inc(struct mount *mnt, struct ve_struct *ve) +static inline int ve_try_reserve_mount(struct ve_struct *ve) { - if (!ve) - ve = get_exec_env(); + int ret = ve_is_super(ve) || ve->is_pseudosuper; + /* Ignore limits in ve0 and pseudosuper cases, but still count. */ + if (ret) + atomic_dec(&ve->mnt_avail_nr); + else + ret = atomic_dec_if_positive(&ve->mnt_avail_nr) >= 0; - mnt->ve_owner = get_ve(ve); - atomic_inc(&ve->mnt_nr); + if (ret) + get_ve(ve); + return ret; } -static inline void ve_mount_nr_dec(struct mount *mnt) +static inline void ve_mount_put(struct mount *mnt, struct ve_struct *ve) { - struct ve_struct *ve = mnt->ve_owner; - - atomic_dec(&ve->mnt_nr); + /* + * ve argument is needed to reuse this function in alloc_vfsmnt error path. + * Other users should pass mnt->ve_owner value. + */ + atomic_inc(&ve->mnt_avail_nr); put_ve(ve); - mnt->ve_owner = NULL; + if (mnt) + mnt->ve_owner = NULL; } /* @@ -3397,9 +3413,9 @@ static inline void ve_mount_reown(struct mount *mnt, struct ve_struct *ve) if (old == ve) return; - atomic_inc(&ve->mnt_nr); + atomic_dec(&ve->mnt_avail_nr); WRITE_ONCE(mnt->ve_owner, get_ve(ve)); - atomic_dec(&old->mnt_nr); + atomic_inc(&old->mnt_avail_nr); put_ve(old); } @@ -3422,10 +3438,10 @@ bool is_sb_ve_accessible(struct ve_struct *ve, struct super_block *sb) #else /* CONFIG_VE */ -static inline int ve_mount_allowed(void) { return 1; } -static inline void ve_mount_nr_inc(struct mount *mnt, struct ve_struct *ve) { } -static inline void ve_mount_nr_dec(struct mount *mnt) { } +static inline int ve_try_reserve_mount(struct ve_struct *ve) { return 1; } +static inline void ve_mount_put(struct mount *mnt, struct ve_struct *ve) { } static inline void ve_mount_reown(struct mount *mnt, struct ve_struct *ve) { } + #endif /* CONFIG_VE */ /* diff --git a/include/linux/ve.h b/include/linux/ve.h index f946abe4d8596..65c058c0f34d4 100644 --- a/include/linux/ve.h +++ b/include/linux/ve.h @@ -96,7 +96,7 @@ struct ve_struct { atomic_t nd_neigh_nr; unsigned long meminfo_val; - atomic_t mnt_nr; /* number of present VE mounts */ + atomic_t mnt_avail_nr; /* number of available VE mounts */ #ifdef CONFIG_COREDUMP char core_pattern[CORENAME_MAX_SIZE]; diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c index e3ae2e5d9a86c..bed8a58af0853 100644 --- a/kernel/ve/ve.c +++ b/kernel/ve/ve.c @@ -82,7 +82,7 @@ struct ve_struct ve0 = { .arp_neigh_nr = ATOMIC_INIT(0), .nd_neigh_nr = ATOMIC_INIT(0), - .mnt_nr = ATOMIC_INIT(0), + .mnt_avail_nr = ATOMIC_INIT(INT_MAX), .meminfo_val = VE_MEMINFO_SYSTEM, .umh_running_helpers = ATOMIC_INIT(0), .umh_helpers_waitq = __WAIT_QUEUE_HEAD_INITIALIZER(ve0.umh_helpers_waitq), @@ -787,7 +787,7 @@ static struct cgroup_subsys_state *ve_create(struct cgroup_subsys_state *parent_ atomic_set(&ve->arp_neigh_nr, 0); atomic_set(&ve->nd_neigh_nr, 0); - atomic_set(&ve->mnt_nr, 0); + atomic_set(&ve->mnt_avail_nr, sysctl_ve_mount_nr); #ifdef CONFIG_COREDUMP strcpy(ve->core_pattern, "core"); @@ -1063,9 +1063,9 @@ static u64 ve_netns_avail_nr_read(struct cgroup_subsys_state *css, struct cftype return atomic_read(&css_to_ve(css)->netns_avail_nr); } -static u64 ve_mnt_nr_read(struct cgroup_subsys_state *css, struct cftype *cft) +static s64 ve_mnt_avail_nr_read(struct cgroup_subsys_state *css, struct cftype *cft) { - return atomic_read(&css_to_ve(css)->mnt_nr); + return atomic_read(&css_to_ve(css)->mnt_avail_nr); } static u64 ve_netif_max_nr_read(struct cgroup_subsys_state *css, struct cftype *cft) @@ -1627,8 +1627,8 @@ static struct cftype ve_cftypes[] = { .read_u64 = ve_netns_avail_nr_read, }, { - .name = "mnt_nr", - .read_u64 = ve_mnt_nr_read, + .name = "mnt_avail_nr", + .read_s64 = ve_mnt_avail_nr_read, }, { .name = "netif_max_nr", -- 2.43.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel