)]}'
{
  "commit": "f2302505775fd13ba93f034206f1e2a587017929",
  "tree": "0397e3cbf7556e93618ed7ad7316578049707ca1",
  "parents": [
    "d5ea7b5ec1ee4dac868143806c0bd94855754677"
  ],
  "author": {
    "name": "Andrew Vagin",
    "email": "avagin@openvz.org",
    "time": "Thu Oct 25 13:38:07 2012 -0700"
  },
  "committer": {
    "name": "Linus Torvalds",
    "email": "torvalds@linux-foundation.org",
    "time": "Thu Oct 25 14:37:53 2012 -0700"
  },
  "message": "pidns: limit the nesting depth of pid namespaces\n\n\u0027struct pid\u0027 is a \"variable sized struct\" - a header with an array of\nupids at the end.\n\nThe size of the array depends on a level (depth) of pid namespaces.  Now a\nlevel of pidns is not limited, so \u0027struct pid\u0027 can be more than one page.\n\nLooks reasonable, that it should be less than a page.  MAX_PIS_NS_LEVEL is\nnot calculated from PAGE_SIZE, because in this case it depends on\narchitectures, config options and it will be reduced, if someone adds a\nnew fields in struct pid or struct upid.\n\nI suggest to set MAX_PIS_NS_LEVEL \u003d 32, because it saves ability to expand\n\"struct pid\" and it\u0027s more than enough for all known for me use-cases.\nWhen someone finds a reasonable use case, we can add a config option or a\nsysctl parameter.\n\nIn addition it will reduce the effect of another problem, when we have\nmany nested namespaces and the oldest one starts dying.\nzap_pid_ns_processe will be called for each namespace and find_vpid will\nbe called for each process in a namespace.  find_vpid will be called\nminimum max_level^2 / 2 times.  The reason of that is that when we found a\nbit in pidmap, we can\u0027t determine this pidns is top for this process or it\nisn\u0027t.\n\nvpid is a heavy operation, so a fork bomb, which create many nested\nnamespace, can make a system inaccessible for a long time.  For example my\nsystem becomes inaccessible for a few minutes with 4000 processes.\n\n[akpm@linux-foundation.org: return -EINVAL in response to excessive nesting, not -ENOMEM]\nSigned-off-by: Andrew Vagin \u003cavagin@openvz.org\u003e\nAcked-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: Cyrill Gorcunov \u003cgorcunov@openvz.org\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "eb00be205811959c708fe2bf5e3aee0547dcfa36",
      "old_mode": 33188,
      "old_path": "kernel/pid_namespace.c",
      "new_id": "7b07cc0dfb75fb6b2f2f802178abf82565d9c1a4",
      "new_mode": 33188,
      "new_path": "kernel/pid_namespace.c"
    }
  ]
}