sys/kern/kern_plimit.c

   1 /*
   2  * Copyright (c) 2006,2017 The DragonFly Project.  All rights reserved.
   3  *
   4  * This code is derived from software contributed to The DragonFly Project
   5  * by Matthew Dillon <dillon@backplane.com>
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in
  15  *    the documentation and/or other materials provided with the
  16  *    distribution.
  17  * 3. Neither the name of The DragonFly Project nor the names of its
  18  *    contributors may be used to endorse or promote products derived
  19  *    from this software without specific, prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
  25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  26  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
  27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
  29  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  30  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  31  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  */
  34 /*
  35  * Copyright (c) 1982, 1986, 1991, 1993
  36  *      The Regents of the University of California.  All rights reserved.
  37  * (c) UNIX System Laboratories, Inc.
  38  * All or some portions of this file are derived from material licensed
  39  * to the University of California by American Telephone and Telegraph
  40  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
  41  * the permission of UNIX System Laboratories, Inc.
  42  *
  43  * Redistribution and use in source and binary forms, with or without
  44  * modification, are permitted provided that the following conditions
  45  * are met:
  46  * 1. Redistributions of source code must retain the above copyright
  47  *    notice, this list of conditions and the following disclaimer.
  48  * 2. Redistributions in binary form must reproduce the above copyright
  49  *    notice, this list of conditions and the following disclaimer in the
  50  *    documentation and/or other materials provided with the distribution.
  51  * 3. Neither the name of the University nor the names of its contributors
  52  *    may be used to endorse or promote products derived from this software
  53  *    without specific prior written permission.
  54  *
  55  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  56  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  57  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  58  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  59  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  60  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  61  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  62  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  63  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  64  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  65  * SUCH DAMAGE.
  66  *
  67  *      @(#)kern_resource.c     8.5 (Berkeley) 1/21/94
  68  */
  69 #include <sys/resource.h>
  70 #include <sys/spinlock.h>
  71 #include <sys/proc.h>
  72 #include <sys/priv.h>
  73 #include <sys/file.h>
  74 #include <sys/lockf.h>
  75 #include <sys/kern_syscall.h>
  76
  77 #include <vm/vm_param.h>
  78 #include <vm/vm.h>
  79 #include <vm/vm_map.h>
  80
  81 #include <machine/pmap.h>
  82
  83 #include <sys/spinlock2.h>
  84
  85 static MALLOC_DEFINE(M_PLIMIT, "plimit", "resource limits");
  86
  87 static void plimit_copy(struct plimit *olimit, struct plimit *nlimit);
  88
  89 /*
  90  * Initialize proc0's plimit structure.  All later plimit structures
  91  * are inherited through fork.
  92  */
  93 void
  94 plimit_init0(struct plimit *limit)
  95 {
  96         int i;
  97         rlim_t lim;
  98
  99         for (i = 0; i < RLIM_NLIMITS; ++i) {
 100                 limit->pl_rlimit[i].rlim_cur = RLIM_INFINITY;
 101                 limit->pl_rlimit[i].rlim_max = RLIM_INFINITY;
 102         }
 103         limit->pl_rlimit[RLIMIT_NOFILE].rlim_cur = maxfiles;
 104         limit->pl_rlimit[RLIMIT_NOFILE].rlim_max = maxfiles;
 105         limit->pl_rlimit[RLIMIT_NPROC].rlim_cur = maxproc;
 106         limit->pl_rlimit[RLIMIT_NPROC].rlim_max = maxproc;
 107         lim = ptoa((rlim_t)vmstats.v_free_count);
 108         limit->pl_rlimit[RLIMIT_RSS].rlim_max = lim;
 109         limit->pl_rlimit[RLIMIT_MEMLOCK].rlim_max = lim;
 110         limit->pl_rlimit[RLIMIT_MEMLOCK].rlim_cur = lim / 3;
 111         limit->p_cpulimit = RLIM_INFINITY;
 112         limit->p_refcnt = 1;
 113         spin_init(&limit->p_spin, "plimitinit");
 114 }
 115
 116 /*
 117  * Return a plimit for use by a new forked process given the one
 118  * contained in the parent process.
 119  */
 120 struct plimit *
 121 plimit_fork(struct proc *p1)
 122 {
 123         struct plimit *olimit = p1->p_limit;
 124         struct plimit *nlimit;
 125         uint32_t count;
 126
 127         /*
 128          * Try to share the parent's plimit structure.  If we cannot, make
 129          * a copy.
 130          *
 131          * NOTE: (count) value is field prior to increment.
 132          */
 133         count = atomic_fetchadd_int(&olimit->p_refcnt, 1);
 134         cpu_ccfence();
 135         if (count & PLIMITF_EXCLUSIVE) {
 136                 if ((count & PLIMITF_MASK) == 1 && p1->p_nthreads == 1) {
 137                         atomic_clear_int(&olimit->p_refcnt, PLIMITF_EXCLUSIVE);
 138                 } else {
 139                         nlimit = kmalloc(sizeof(*nlimit), M_PLIMIT, M_WAITOK);
 140                         plimit_copy(olimit, nlimit);
 141                         olimit = nlimit;
 142                 }
 143         }
 144         return olimit;
 145 }
 146
 147 /*
 148  * This routine is called when a new LWP is created for a process.  We
 149  * must force exclusivity to ensure that p->p_limit remains stable.
 150  *
 151  * LWPs share the same process structure so this does not bump refcnt.
 152  */
 153 void
 154 plimit_lwp_fork(struct proc *p)
 155 {
 156         struct plimit *olimit = p->p_limit;
 157         struct plimit *nlimit;
 158         uint32_t count;
 159
 160         count = olimit->p_refcnt;
 161         cpu_ccfence();
 162         if ((count & PLIMITF_EXCLUSIVE) == 0) {
 163                 if (count != 1) {
 164                         nlimit = kmalloc(sizeof(*nlimit), M_PLIMIT, M_WAITOK);
 165                         plimit_copy(olimit, nlimit);
 166                         p->p_limit = nlimit;
 167                         plimit_free(olimit);
 168                         olimit = nlimit;
 169                 }
 170                 atomic_set_int(&olimit->p_refcnt, PLIMITF_EXCLUSIVE);
 171         }
 172 }
 173
 174 /*
 175  * This routine is called to fixup a process's p_limit structure prior
 176  * to it being modified.  If index >= 0 the specified modification is also
 177  * made.
 178  *
 179  * This routine must make the limit structure exclusive.  If we are threaded,
 180  * the structure will already be exclusive.  A later fork will convert it
 181  * back to copy-on-write if possible.
 182  *
 183  * We can count on p->p_limit being stable since if we had created any
 184  * threads it will have already been made exclusive.
 185  */
 186 void
 187 plimit_modify(struct proc *p, int index, struct rlimit *rlim)
 188 {
 189         struct plimit *olimit;
 190         struct plimit *nlimit;
 191         uint32_t count;
 192
 193         /*
 194          * Make exclusive
 195          */
 196         olimit = p->p_limit;
 197         count = olimit->p_refcnt;
 198         cpu_ccfence();
 199         if ((count & PLIMITF_EXCLUSIVE) == 0) {
 200                 if (count != 1) {
 201                         nlimit = kmalloc(sizeof(*nlimit), M_PLIMIT, M_WAITOK);
 202                         plimit_copy(olimit, nlimit);
 203                         p->p_limit = nlimit;
 204                         plimit_free(olimit);
 205                         olimit = nlimit;
 206                 }
 207                 atomic_set_int(&olimit->p_refcnt, PLIMITF_EXCLUSIVE);
 208         }
 209
 210         /*
 211          * Make modification
 212          */
 213         if (index >= 0) {
 214                 if (p->p_nthreads == 1) {
 215                         p->p_limit->pl_rlimit[index] = *rlim;
 216                 } else {
 217                         spin_lock(&olimit->p_spin);
 218                         p->p_limit->pl_rlimit[index].rlim_cur = rlim->rlim_cur;
 219                         p->p_limit->pl_rlimit[index].rlim_max = rlim->rlim_max;
 220                         spin_unlock(&olimit->p_spin);
 221                 }
 222         }
 223 }
 224
 225 /*
 226  * Destroy a process's plimit structure.
 227  */
 228 void
 229 plimit_free(struct plimit *limit)
 230 {
 231         uint32_t count;
 232
 233         count = atomic_fetchadd_int(&limit->p_refcnt, -1);
 234
 235         if ((count & ~PLIMITF_EXCLUSIVE) == 1) {
 236                 limit->p_refcnt = -999;
 237                 kfree(limit, M_PLIMIT);
 238         }
 239 }
 240
 241 /*
 242  * Modify a resource limit (from system call)
 243  */
 244 int
 245 kern_setrlimit(u_int which, struct rlimit *limp)
 246 {
 247         struct proc *p = curproc;
 248         struct plimit *limit;
 249         struct rlimit *alimp;
 250         int error;
 251
 252         if (which >= RLIM_NLIMITS)
 253                 return (EINVAL);
 254
 255         /*
 256          * We will be modifying a resource, make a copy if necessary.
 257          */
 258         plimit_modify(p, -1, NULL);
 259         limit = p->p_limit;
 260         alimp = &limit->pl_rlimit[which];
 261
 262         /*
 263          * Preserve historical bugs by treating negative limits as unsigned.
 264          */
 265         if (limp->rlim_cur < 0)
 266                 limp->rlim_cur = RLIM_INFINITY;
 267         if (limp->rlim_max < 0)
 268                 limp->rlim_max = RLIM_INFINITY;
 269
 270         spin_lock(&limit->p_spin);
 271         if (limp->rlim_cur > alimp->rlim_max ||
 272             limp->rlim_max > alimp->rlim_max) {
 273                 spin_unlock(&limit->p_spin);
 274                 error = priv_check_cred(p->p_ucred, PRIV_PROC_SETRLIMIT, 0);
 275                 if (error)
 276                         return (error);
 277         } else {
 278                 spin_unlock(&limit->p_spin);
 279         }
 280         if (limp->rlim_cur > limp->rlim_max)
 281                 limp->rlim_cur = limp->rlim_max;
 282
 283         switch (which) {
 284         case RLIMIT_CPU:
 285                 spin_lock(&limit->p_spin);
 286                 if (limp->rlim_cur > RLIM_INFINITY / (rlim_t)1000000)
 287                         limit->p_cpulimit = RLIM_INFINITY;
 288                 else
 289                         limit->p_cpulimit = (rlim_t)1000000 * limp->rlim_cur;
 290                 spin_unlock(&limit->p_spin);
 291                 break;
 292         case RLIMIT_DATA:
 293                 if (limp->rlim_cur > maxdsiz)
 294                         limp->rlim_cur = maxdsiz;
 295                 if (limp->rlim_max > maxdsiz)
 296                         limp->rlim_max = maxdsiz;
 297                 break;
 298
 299         case RLIMIT_STACK:
 300                 if (limp->rlim_cur > maxssiz)
 301                         limp->rlim_cur = maxssiz;
 302                 if (limp->rlim_max > maxssiz)
 303                         limp->rlim_max = maxssiz;
 304                 /*
 305                  * Stack is allocated to the max at exec time with only
 306                  * "rlim_cur" bytes accessible.  If stack limit is going
 307                  * up make more accessible, if going down make inaccessible.
 308                  */
 309                 spin_lock(&limit->p_spin);
 310                 if (limp->rlim_cur != alimp->rlim_cur) {
 311                         vm_offset_t addr;
 312                         vm_size_t size;
 313                         vm_prot_t prot;
 314
 315                         if (limp->rlim_cur > alimp->rlim_cur) {
 316                                 prot = VM_PROT_ALL;
 317                                 size = limp->rlim_cur - alimp->rlim_cur;
 318                                 addr = USRSTACK - limp->rlim_cur;
 319                         } else {
 320                                 prot = VM_PROT_NONE;
 321                                 size = alimp->rlim_cur - limp->rlim_cur;
 322                                 addr = USRSTACK - alimp->rlim_cur;
 323                         }
 324                         spin_unlock(&limit->p_spin);
 325                         addr = trunc_page(addr);
 326                         size = round_page(size);
 327                         vm_map_protect(&p->p_vmspace->vm_map,
 328                                        addr, addr+size, prot, FALSE);
 329                 } else {
 330                         spin_unlock(&limit->p_spin);
 331                 }
 332                 break;
 333
 334         case RLIMIT_NOFILE:
 335                 if (limp->rlim_cur > maxfilesperproc)
 336                         limp->rlim_cur = maxfilesperproc;
 337                 if (limp->rlim_max > maxfilesperproc)
 338                         limp->rlim_max = maxfilesperproc;
 339                 break;
 340
 341         case RLIMIT_NPROC:
 342                 if (limp->rlim_cur > maxprocperuid)
 343                         limp->rlim_cur = maxprocperuid;
 344                 if (limp->rlim_max > maxprocperuid)
 345                         limp->rlim_max = maxprocperuid;
 346                 if (limp->rlim_cur < 1)
 347                         limp->rlim_cur = 1;
 348                 if (limp->rlim_max < 1)
 349                         limp->rlim_max = 1;
 350                 break;
 351         case RLIMIT_POSIXLOCKS:
 352                 if (limp->rlim_cur > maxposixlocksperuid)
 353                         limp->rlim_cur = maxposixlocksperuid;
 354                 if (limp->rlim_max > maxposixlocksperuid)
 355                         limp->rlim_max = maxposixlocksperuid;
 356                 break;
 357         }
 358         spin_lock(&limit->p_spin);
 359         *alimp = *limp;
 360         spin_unlock(&limit->p_spin);
 361         return (0);
 362 }
 363
 364 /*
 365  * The rlimit indexed by which is returned in the second argument.
 366  */
 367 int
 368 kern_getrlimit(u_int which, struct rlimit *limp)
 369 {
 370         struct proc *p = curproc;
 371         struct plimit *limit;
 372
 373         /*
 374          * p is NULL when kern_getrlimit is called from a
 375          * kernel thread. In this case as the calling proc
 376          * isn't available we just skip the limit check.
 377          */
 378         if (p == NULL)
 379                 return 0;
 380
 381         if (which >= RLIM_NLIMITS)
 382                 return (EINVAL);
 383
 384         limit = p->p_limit;
 385         *limp = p->p_rlimit[which];
 386
 387         return (0);
 388 }
 389
 390 /*
 391  * Determine if the cpu limit has been reached and return an operations
 392  * code for the caller to perform.
 393  */
 394 int
 395 plimit_testcpulimit(struct plimit *limit, u_int64_t ttime)
 396 {
 397         struct rlimit *rlim;
 398         int mode;
 399
 400         /*
 401          * Initial tests without the spinlock.  This is the fast path.
 402          * Any 32/64 bit glitches will fall through and retest with
 403          * the spinlock.
 404          */
 405         if (limit->p_cpulimit == RLIM_INFINITY)
 406                 return(PLIMIT_TESTCPU_OK);
 407         if (ttime <= limit->p_cpulimit)
 408                 return(PLIMIT_TESTCPU_OK);
 409
 410         if (ttime > limit->p_cpulimit) {
 411                 rlim = &limit->pl_rlimit[RLIMIT_CPU];
 412                 if (ttime / (rlim_t)1000000 >= rlim->rlim_max + 5)
 413                         mode = PLIMIT_TESTCPU_KILL;
 414                 else
 415                         mode = PLIMIT_TESTCPU_XCPU;
 416         } else {
 417                 mode = PLIMIT_TESTCPU_OK;
 418         }
 419
 420         return(mode);
 421 }
 422
 423 /*
 424  * Helper routine to copy olimit to nlimit and initialize nlimit for
 425  * use.  nlimit's reference count will be set to 1 and its exclusive bit
 426  * will be cleared.
 427  */
 428 static
 429 void
 430 plimit_copy(struct plimit *olimit, struct plimit *nlimit)
 431 {
 432         *nlimit = *olimit;
 433
 434         spin_init(&nlimit->p_spin, "plimitcopy");
 435         nlimit->p_refcnt = 1;
 436 }
 437
 438 /*
 439  * This routine returns the value of a resource, downscaled based on
 440  * the processes fork depth and chroot depth (up to 50%).  This mechanism
 441  * is designed to prevent run-aways from blowing up unrelated processes
 442  * running under the same UID.
 443  *
 444  * NOTE: Currently only applicable to RLIMIT_NPROC.  We could also limit
 445  *       file descriptors but we shouldn't have to as these are allocated
 446  *       dynamically.
 447  */
 448 u_int64_t
 449 plimit_getadjvalue(int i)
 450 {
 451         struct proc *p = curproc;
 452         struct plimit *limit;
 453         uint64_t v;
 454         uint32_t depth;
 455
 456         limit = p->p_limit;
 457         v = limit->pl_rlimit[i].rlim_cur;
 458         if (i == RLIMIT_NPROC) {
 459                 /*
 460                  * 10% per chroot (around 1/3% per fork depth), with a
 461                  * maximum of 50% downscaling of the resource limit.
 462                  */
 463                 depth = p->p_depth;
 464                 if (depth > 32 * 5)
 465                         depth = 32 * 5;
 466                 v -= v * depth / 320;
 467         }
 468         return v;
 469 }