The value of the cpuset.stat process field will be abnormal in
some scenarios. The reason for this problem is that the sum of
process_counts may be negative for several cpus.
Signed-off-by: brookxu <brookxu@tencent.com>
In order to facilitate each container to obtain its own IO statistics,
we implement per blkcg diskstats and expose some data from the host
into the container such as io_ticks.
Signed-off-by: Chunguang Xu <brookxu@tencent.com>
[upstream commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff]
Jonathan Looney reported that TCP can trigger the following crash
in tcp_shifted_skb() :
BUG_ON(tcp_skb_pcount(skb) < pcount);
This can happen if the remote peer has advertized the smallest
MSS that linux TCP accepts : 48
An skb can hold 17 fragments, and each fragment can hold 32KB
on x86, or 64KB on PowerPC.
This means that the 16bit witdh of TCP_SKB_CB(skb)->tcp_gso_segs
can overflow.
Note that tcp_sendmsg() builds skbs with less than 64KB
of payload, so this problem needs SACK to be enabled.
SACK blocks allow TCP to coalesce multiple skbs in the retransmit
queue, thus filling the 17 fragments to maximal capacity.
CVE-2019-11477 -- u16 overflow of TCP_SKB_CB(skb)->tcp_gso_segs
[upstream commit cd4ffa93f16efea290bb70537f98f518e1927e63]
tcp: fix fack_count accounting on
tcp_shift_skb_data()
v4.15 or since commit 737ff314563 ("tcp: use sequence distance to
detect reordering") had switched from the packet-based FACK tracking
to sequence-based.
v4.14 and older still have the old logic and hence on
tcp_skb_shift_data() needs to retain its original logic and have
@fack_count in sync. In other words, we keep the increment of pcount
with
tcp_skb_pcount(skb) to later used that to update fack_count. To make it
more explicit we track the new skb that gets incremented to pcount in
@next_pcount, and we get to avoid the constant invocation of
tcp_skb_pcount(skb) all together.
Fixes: a5f1faa40101 ("tcp: limit payload size of sacked skbs")
Fixes: 832d11c5cd07 ("tcp: Try to restore large SKBs while SACK processing")
Signed-off-by: Zhiping Du <zhipingdu@tencent.com>
When use-gss-proxy is set to 1, write_gssp will lead to 2 get_net calls
in gssp_rpc_create, the paired put_net calls are supposed to be made
in rpcsec_gss_net_ops->exit i.e. rpcsec_gss_exit_net, but this will
never happen because rpcsec_gss_exit_net (via ops_exit_list) is called
by cleanup_net and cleanup_net will never run unless net->count becomes
0, since the paired put_net calls of gssp_rpc_create are not made yet,
net->count cannot drop to 0. This is dead lock situation.
This fix introduced a new method i.e. evict in struct proc_ns_operations,
which is called in nsfs_evict, moving rpcsec_gss_exit_net into the code
path of nsfs_evict gives it a chance to run.
Signed-off-by: Wenbin Zeng <wenbinzeng@tencent.com>
add /proc/sys/vm/vm_pagecache_limit_async interface which
allow page caches reclaimed in kpclimitd, it will not consume
work threads runtime, but oom may be occured. it's closed default.
Signed-off-by: Zhiping Du <zhipingdu@tencent.com>
Signed-off-by: Chunguang Xu <brookxu@tencent.com>
We add cpuinfo and stat for each container which
used for docker to get cpu stat just for current
container.
Signed-off-by: Xiaoming Gao <newtongao@tencent.com>
Signed-off-by: Weiwei Li <nuonuoli@tencent.com>
Signed-off-by: Liu Hua <shookliu@tencent.com>
the print_fatal_signals sysctl can only dump fatal signals from receiver's side,
cannot find who and why send these fatal signals, so add a new sysctl
print_fatal_signals_src_dst to switch dump fatal signals from sender side.
Signed-off-by: Xiaoming Gao <newtongao@tencent.com>
create a pid mapping data to parent processes in file /proc/$PID/status
create a proc file (/proc/$PID/hostinfo), mapping pid data to host pid
Signed-off-by: Lorin Liu <lorinliu@tencent.com>
brookxu