[Devel] [PATCH hci-8.1 0/2] ve/fs: allow host to go over container mount limit

[Devel] [PATCH hci-8.1 0/2] ve/fs: allow host to go over container mount limit

[Pavel Tikhomirov]

Since 22.4 CRIU fails to dump a container which is close to its mount
limit:

  Error (criu/mount.c:1740): mnt: Unable to unshare a mount namespace: Cannot allocate memory

To get access to overmounted mounts, CRIU (in ve0) copies the container
mount namespace. The copied mounts are owned by and charged to the
container, and now the container limit is also checked for them, so the
host is restricted by the container limit.

Patch 1 relaxes the limit for ve0 (still counting, as for pseudosuper),
patch 2 adds a selftest for it.

https://virtuozzo.atlassian.net/browse/VSTOR-147661

Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
---
Pavel Tikhomirov (2):
      ve/fs: allow host to go over limit of container mount namespace
      selftests/ve: check that host can go over container mount limit

 fs/namespace.c                                     |  3 +-
 .../selftests/ve/ve_mount_accounting_test.c        | 37 ++++++++++++++++++++++
 2 files changed, 39 insertions(+), 1 deletion(-)
---
base-commit: ca54f152160587a74ff17cb52feef16f7b9d4e2b
change-id: 20260928-b4-ve0-mnt-limit-5bdc176203a4

Best regards,
--  
Pavel Tikhomirov <ptikhomirov@virtuozzo.com>

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH hci-8.1 1/2] ve/fs: allow host to go over limit of container mount namespace

[Pavel Tikhomirov]

This is something that CRIU does on dump, to get access to some mounts
(under overmounts) we have to have a copy of namespace where we can try
umounting stuff which covers the path.

Together [1] + [2] lead to those mounts been accounted to ve and not
allowed to go over the limit leading to CRIU fail. Let's relax it back.

[1] commit c53e7bc5f513 ("ve/fs: take the owner of copied mounts from the
namespace, not the task")

https://virtuozzo.atlassian.net/browse/VSTOR-147661
Feature: per-ve failcounters
Fixes: b9c2e2d6ee85 ("ve/fs: count available mounts instead of used ones") [2]
Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
---
 fs/namespace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/namespace.c b/fs/namespace.c
index cf77c3fb98407..75cabf7763ef6 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -3367,7 +3367,8 @@ int ve_devmnt_verify(struct ve_struct *ve, dev_t dev, char *opts, bool new_mount
 
 static inline int ve_try_reserve_mount(struct ve_struct *ve)
 {
-	int ret = ve_is_super(ve) || ve->is_pseudosuper;
+	int ret = ve_is_super(ve) || ve->is_pseudosuper ||
+		  ve_is_super(get_exec_env());
 	/* Ignore limits in ve0 and pseudosuper cases, but still count. */
 	if (ret)
 		atomic_dec(&ve->mnt_avail_nr);

-- 
2.55.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH hci-8.1 2/2] selftests/ve: check that host can go over container mount limit

[Pavel Tikhomirov]

Like pseudosuper_allows_overuse, check that a bind mount done from ve0
in the container mount namespace succeeds when the container has no
mounts left, and is charged to the container.

https://virtuozzo.atlassian.net/browse/VSTOR-147661
Feature: per-ve failcounters
Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
---
 .../selftests/ve/ve_mount_accounting_test.c        | 37 ++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/tools/testing/selftests/ve/ve_mount_accounting_test.c b/tools/testing/selftests/ve/ve_mount_accounting_test.c
index e2a882137e11d..8bb13e9615427 100644
--- a/tools/testing/selftests/ve/ve_mount_accounting_test.c
+++ b/tools/testing/selftests/ve/ve_mount_accounting_test.c
@@ -539,6 +539,43 @@ TEST_F(ve_mnt_acc, failcount)
 	ASSERT_TRUE(strstr(failcount_str, "mnt: 1\n") != NULL);
 }
 
+static int _create_bind_mount(void *id_ptr)
+{
+	char path[PATH_MAX];
+	int id = *(int *)id_ptr;
+
+	snprintf(path, sizeof(path), TMP_DIR "%d", id);
+
+	if (mkdir(path, 0755) < 0) {
+		fprintf(stderr, "Failed to create directory %s: %s\n", path, strerror(errno));
+		return -1;
+	}
+	if (!mount(path, path, NULL, MS_BIND, NULL))
+		return 0;
+	fprintf(stderr, "Failed to bind mount %s: %s\n", path, strerror(errno));
+
+	rmdir(path);
+	return -1;
+}
+
+/* Test that host can go over the limit in container mount namespace. */
+TEST_F(ve_mnt_acc, host_allows_overuse)
+{
+	char path_max_nr[64];
+	int id = 0;
+
+	snprintf(path_max_nr, sizeof(path_max_nr), "%d/ve.mnt_max_nr", self->ctid);
+
+	ASSERT_EQ(write_u64_at(self->cgv2_fd, path_max_nr, self->orig_have_mnt), 0);
+
+	/* Bind mount from ve0, charged to the container's mount namespace owner */
+	ASSERT_EQ(run_in_ve(self->cgv2_fd, self->ctid, &self->ns_ctx,
+			    CLONE_NEWNS, _create_bind_mount, &id), 0);
+	ASSERT_EQ(wait_on_mnt_avail(self, -1), 0);
+
+	ASSERT_EQ(destroy_mount(self, 0), 0);
+}
+
 int main(int argc, char **argv)
 {
 	need_avail = mmap(NULL, sizeof(int),

-- 
2.55.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1 0/2] ve/fs: allow host to go over container mount limit

[Konstantin Khorenko]

On Mon, 28 Sep 2026 17:24:56 +0200, Pavel Tikhomirov <ptikhomirov@virtuozzo.com> wrote:
> ve/fs: allow host to go over container mount limit
> 
> Since 22.4 CRIU fails to dump a container which is close to its mount
> limit:
> 
>   Error (criu/mount.c:1740): mnt: Unable to unshare a mount namespace: Cannot allocate memory
> 
> [...]

Reviewed-by: Konstantin Khorenko <khorenko@virtuozzo.com>

-- 
Konstantin Khorenko <khorenko@virtuozzo.com>
_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1 0/2] ve/fs: allow host to go over container mount limit

[Konstantin Khorenko]

On Mon, 28 Sep 2026 17:24:56 +0200, Pavel Tikhomirov wrote:
> ve/fs: allow host to go over container mount limit
> 
> Since 22.4 CRIU fails to dump a container which is close to its mount
> limit:
> 
>   Error (criu/mount.c:1740): mnt: Unable to unshare a mount namespace: Cannot allocate memory
> 
> [...]

Applied to branch-rh10-6.12.0-211.52.1.22.x.vz10-ovz, will be released in rh10-6.12.0-211.52.1.22.5.vz10, thanks!

[1/2] ve/fs: allow host to go over limit of container mount namespace
      https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/e6358d78bde7
[2/2] selftests/ve: check that host can go over container mount limit
      https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/95abfad2aff6

-- 
Konstantin Khorenko <khorenko@virtuozzo.com>

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel