Re: [PATCH] fs/pipe: use kvcalloc to allocate a pipe_buffer array

[Andrei Vagin]

On Tue, Jan 4, 2022 at 10:54 PM Dmitry Safonov <0x7f454c46@xxxxxxxxx> wrote:
>
> On 1/4/22 17:10, Andrei Vagin wrote:
> > Right now, kcalloc is used to allocate a pipe_buffer array.  The size of
> > the pipe_buffer struct is 40 bytes. kcalloc allows allocating reliably
> > chunks with sizes less or equal to PAGE_ALLOC_COSTLY_ORDER (3). It means
> > that the maximum pipe size is 3.2MB in this case.
> >
> > In CRIU, we use pipes to dump processes memory. CRIU freezes a target
> > process, injects a parasite code into it and then this code splices
> > memory into pipes. If a maximum pipe size is small, we need to
> > do many iterations or create many pipes.
> >
> > kvcalloc attempt to allocate physically contiguous memory, but upon
> > failure, fall back to non-contiguous (vmalloc) allocation and so it
> > isn't limited by PAGE_ALLOC_COSTLY_ORDER.
> >
> > The maximum pipe size for non-root users is limited by
> > the /proc/sys/fs/pipe-max-size sysctl that is 1MB by default, so only
> > the root user will be able to trigger vmalloc allocations.
> >
> > Cc: Dmitry Safonov <0x7f454c46@xxxxxxxxx>
> > Signed-off-by: Andrei Vagin <avagin@xxxxxxxxx>
>
> Good idea!
>
> I wonder if you need to apply this on the top:
>
> diff --git a/fs/pipe.c b/fs/pipe.c
> index 45565773ec33..b4ccafffa350 100644
> --- a/fs/pipe.c
> +++ b/fs/pipe.c
> @@ -605,7 +605,7 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from)
>  static long pipe_ioctl(struct file *filp, unsigned int cmd, unsigned
> long arg)
>  {
>         struct pipe_inode_info *pipe = filp->private_data;
> -       int count, head, tail, mask;
> +       unsigned int count, head, tail, mask;
>
>         switch (cmd) {
>         case FIONREAD:
> @@ -827,7 +827,7 @@ struct pipe_inode_info *alloc_pipe_info(void)
>
>  void free_pipe_info(struct pipe_inode_info *pipe)
>  {
> -       int i;
> +       unsigned int i;
>
>  #ifdef CONFIG_WATCH_QUEUE
>         if (pipe->watch_queue) {
> --->8---
>
> Otherwise this loop in free_pipe_info() may become lockup on some ugly
> platforms with INTMAX allocation reachable, I think. I may be wrong :-)

This change looks reasonable, it makes types of local variables consistent
with proper fields of pipe_inode_info. But right now, the maximum pipe size
is limited by (1<<31) (look at round_pipe_size) and so we don't have a real
issue here.

Thanks,
Andrei