From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=91.218.175.56 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793971167; b=5B8eTtvrYTu/QGhQs5iFVT8HhqZ4zZ5d79ZXziRyUjmbCiLdoGTBA8asMtjjJBQRduec c80d3Y77libVZ9PQabV/3e+OpPiqjBcai2BvI3kk+tYf2RFQQDVG2kt08gzrqw4m5Sn97 jHVqXvS2hZF6ImCSN8k7hd/GKhm0x1i1S1bsJQXAGH5pC+VhQa0kTH/fCYX1YeSUWtsux rsYpWQ9E7is+xsqYgc0VckdYLvv0sT8VEosXIAGPEQghqu3Qtfg8wKSXxtHITQ6w5AJso HgAyIRtspayIFiAoAChjW90en/U00sGGOhtAqzUH/6K0LYYrjfeLV1j41Ewldxb5hVg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793971167; h=DMARC-Filter:X-Envelope-To:DKIM-Signature:X-Envelope-To:Received: X-Mizu-Trace-ID:X-Migadu-Flow:From:To:Cc:Subject:Date:Message-ID: X-Mailer:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding; bh=OjxbtrTpVECakggq3aaOcAKtXEWGwtyTzHqRGiNRk7Q=; b=A6ddrXFy0/lvs/c+20E9OZkYkV3biC3qHdKmwWpHmVRJfJoNnANAPN+Wt2m2Ywd55mrl YpX/QMs28k2vZM0vvdson2V+I1228186e6eDQVx6GVKjcZKemEm22sr1VvRFFOLReprko PJNWKYnpLMtdznDKs8Xzb+X9NCbz0ua4Ie7uugksp/0UXsvOSusS3Qoqtj+VuaaSxb/nQ 5j4FSuawucMnP6Wrwuab8mLO2lKShWVvYyxlCgM1dVR/7jgUUcKlD3e8dPkfW69YFU4Xu K6pU+4+e6rYuidhhk4GYUIlhWXG9XtkhZyU7fvqwATn9uegW3eEjBfMOpGEzdAbVkKg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass header.d=linux.dev header.i=@linux.dev header.a=rsa-sha256 header.s=key1 header.b=jeFNHfv5; arc=none smtp.remote-ip=91.218.175.56 Received: from mta0.migadu.com (out-56.mta0.migadu.com [91.218.175.56]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0AFF0606A32F for ; Fri, 6 Nov 2026 13:19:26 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 0AFF0606A32F Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linux.dev header.i=@linux.dev header.a=rsa-sha256 header.s=key1 header.b=jeFNHfv5 X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=KO2+Pw/HQKx0a4JyoCFPhhmUGDsn7IBoIsdjd3UIB1k=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1793971165; v=1; x=1794575965; b=jeFNHfv5f4zmg3psPVOfCRejiIcbH0mRSeUBXfYvbsOUUduFnoh4Xb/lFO75h7OZwr3xb52j hl5asAf3vpi1tP7ZCwkufcg0keAVYJ9DH3vunUx+P7OTGGe6hcvnkzOe8I6jXRUX5LbI2tCx1XU DqQcY5Z6CBplWlVJlLCwbnXY= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id 99a7a9ba11e11fd9; Fri, 06 Nov 2026 13:19:24 +0000 X-Mizu-Trace-ID: 99a7a9ba11e11fd9 X-Migadu-Flow: FLOW_OUT From: Tao Cui To: akpm@linux-foundation.org, dgilbert@interlog.com, mkp@kernel.org, loberman@redhat.com, jmeneghi@redhat.com, kraxel@redhat.com, vivek.kasireddy@intel.com, mst@redhat.com, jasowangio@gmail.com, eperezma@redhat.com, stefanha@redhat.com, sgarzare@redhat.com, rostedt@goodmis.org, vdonnefort@google.com, mhiramat@kernel.org, jgg@ziepe.ca, kevin.tian@intel.com, axboe@kernel.dk Cc: linux-mm@kvack.org, James.Bottomley@HansenPartnership.com, sumit.semwal@linaro.org, christian.koenig@amd.com, phasta@kernel.org, joro@8bytes.org, will@kernel.org, linux-scsi@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-media@vger.kernel.org, linaro-mm-sig@lists.linaro.org, kvm@vger.kernel.org, virtualization@lists.linux.dev, linux-trace-kernel@vger.kernel.org, iommu@lists.linux.dev, io-uring@vger.kernel.org, linux-kernel@vger.kernel.org, bobbyeshleman@meta.com, mathieu.desnoyers@efficios.com, robin.murphy@arm.com, mason@kernel.org, aesteve@redhat.com, tjmercier@google.com, harry@kernel.org, vbabka@suse.cz, cui.tao@linux.dev, cuitao@kylinos.cn Subject: [PATCH 1/7] scsi: sg and st: account the command buffer memory to memcg Date: Fri, 6 Nov 2026 21:18:23 +0800 Message-ID: <20261106131829.3228926-2-cui.tao@linux.dev> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261106131829.3228926-1-cui.tao@linux.dev> References: <20261106131829.3228926-1-cui.tao@linux.dev> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Tao Cui The sg data buffers are unaccounted: the per-fd reserved buffer, the scatter-gather page array, and the order-0..N pages behind it, plus the per-device tape buffer in st. All of it is user controllable. The reserved size is capped only by the device max_sectors, SG_MAX_QUEUE (16) commands can be in flight per fd, and the fd count is bounded by RLIMIT_NOFILE. Nothing is charged to the memcg of the process driving it. The September 2026 fixes in sg_build_indirect reshaped the element sizing and left the accounting alone. Mark these allocations __GFP_ACCOUNT so the driving process pays for the memory it induces. Signed-off-by: Tao Cui --- drivers/scsi/sg.c | 23 ++++++++++++++++++++--- drivers/scsi/st.c | 7 ++++--- 2 files changed, 24 insertions(+), 6 deletions(-) diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c index 6551f1284d44..9c1414479b21 100644 --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -911,6 +911,19 @@ static int put_compat_request_table(struct compat_sg_req_info __user *o, } #endif +/* + * The sg passthrough of the blktrace ioctls has the same exposure as the + * block device path: holding the node is the only requirement today, and + * a created trace outlives the fd. Must match the gate in + * blk_trace_ioctl(). + */ +static bool sg_is_blktrace_cmd(unsigned int cmd) +{ + return cmd == BLKTRACESETUP || cmd == BLKTRACESETUP2 || + cmd == BLKTRACESTART || cmd == BLKTRACESTOP || + cmd == BLKTRACETEARDOWN; +} + static long sg_ioctl_common(struct file *filp, Sg_device *sdp, Sg_fd *sfp, unsigned int cmd_in, void __user *p) @@ -920,6 +933,9 @@ sg_ioctl_common(struct file *filp, Sg_device *sdp, Sg_fd *sfp, Sg_request *srp; unsigned long iflags; + if (sg_is_blktrace_cmd(cmd_in) && !capable(CAP_SYS_ADMIN)) + return -EPERM; + SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp, "sg_ioctl: cmd=0x%x\n", (int) cmd_in)); read_only = (O_RDWR != (filp->f_flags & O_ACCMODE)); @@ -1829,7 +1845,7 @@ static int sg_build_sgat(Sg_scatter_hold * schp, const Sg_fd * sfp, int tablesize) { int sg_bufflen = tablesize * sizeof(struct page *); - gfp_t gfp_flags = GFP_ATOMIC | __GFP_NOWARN; + gfp_t gfp_flags = GFP_ATOMIC | __GFP_NOWARN | __GFP_ACCOUNT; schp->pages = kzalloc(sg_bufflen, gfp_flags); if (!schp->pages) @@ -1844,7 +1860,8 @@ sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size) int ret_sz = 0, i, k, rem_sz, num, mx_sc_elems; int sg_tablesize = sfp->parentdp->sg_tablesize; int blk_size = buff_size, order; - gfp_t gfp_mask = GFP_ATOMIC | __GFP_COMP | __GFP_NOWARN | __GFP_ZERO; + gfp_t gfp_mask = GFP_ATOMIC | __GFP_COMP | __GFP_NOWARN | + __GFP_ACCOUNT | __GFP_ZERO; if (blk_size < 0) return -EFAULT; @@ -2134,7 +2151,7 @@ sg_add_sfp(Sg_device * sdp) unsigned long iflags; int bufflen; - sfp = kzalloc_obj(*sfp, GFP_ATOMIC | __GFP_NOWARN); + sfp = kzalloc_obj(*sfp, GFP_ATOMIC | __GFP_NOWARN | __GFP_ACCOUNT); if (!sfp) return ERR_PTR(-ENOMEM); diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c index e9d41e3cc2dd..b92633ab2757 100644 --- a/drivers/scsi/st.c +++ b/drivers/scsi/st.c @@ -4074,7 +4074,7 @@ static struct st_buffer *new_tape_buffer(int max_sg) { struct st_buffer *tb; - tb = kzalloc_obj(struct st_buffer); + tb = kzalloc_obj(struct st_buffer, GFP_KERNEL_ACCOUNT); if (!tb) { printk(KERN_NOTICE "st: Can't allocate new tape buffer.\n"); return NULL; @@ -4083,7 +4083,8 @@ static struct st_buffer *new_tape_buffer(int max_sg) tb->use_sg = max_sg; tb->buffer_size = 0; - tb->reserved_pages = kzalloc_objs(struct page *, max_sg); + tb->reserved_pages = kzalloc_objs(struct page *, max_sg, + GFP_KERNEL_ACCOUNT); if (!tb->reserved_pages) { kfree(tb); return NULL; @@ -4109,7 +4110,7 @@ static int enlarge_buffer(struct st_buffer * STbuffer, int new_size) max_segs = STbuffer->use_sg; - priority = GFP_KERNEL | __GFP_NOWARN; + priority = GFP_KERNEL | __GFP_NOWARN | __GFP_ACCOUNT; if (STbuffer->cleared) priority |= __GFP_ZERO; -- 2.43.0