mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-11 06:03:57 +08:00
Aleksa Sarai
753884a0ff
Previously, we would see a ~3% failure rate when starting containers with mounts that contain ".." (which can trigger -EAGAIN). To counteract this, filepath-securejoin v0.5.1 includes a bump of the internal retry limit from 32 to 128, which lowers the failure rate to 0.12%. However, there is still a risk of spurious failure on regular systems. In order to try to provide more resilience (while avoiding DoS attacks), this patch also includes an additional retry loop that terminates based on a deadline rather than retry count. The deadline is 2ms, as my testing found that ~800us for a single pathrs operation was the longest latency due to -EAGAIN retries, and that was an outlier compared to the more common ~400us latencies -- so 2ms should be more than enough for any real system. The failure rates above were based on more 50k runs of runc with an attack script (from libpathrs) running a rename attack on all cores of a 16-core system, which is arguably a worst-case but heavily utilised servers could likely approach similar results. Tested-by: Phil Estes <estesp@gmail.com> Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
67 lines
2.0 KiB
Go
67 lines
2.0 KiB
Go
// SPDX-License-Identifier: Apache-2.0
|
|
/*
|
|
* Copyright (C) 2024-2025 Aleksa Sarai <cyphar@cyphar.com>
|
|
* Copyright (C) 2024-2025 SUSE LLC
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
package pathrs
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"time"
|
|
|
|
"golang.org/x/sys/unix"
|
|
)
|
|
|
|
// Based on >50k tests running "runc run" on a 16-core system with very heavy
|
|
// rename(2) load, the single longest latency caused by -EAGAIN retries was
|
|
// ~800us (with the vast majority being closer to 400us). So, a 2ms limit
|
|
// should give more than enough headroom for any real system in practice.
|
|
const retryDeadline = 2 * time.Millisecond
|
|
|
|
// retryEAGAIN is a top-level retry loop for pathrs to try to returning
|
|
// spurious errors in most normal user cases when using openat2 (libpathrs
|
|
// itself does up to 128 retries already, but this method takes a
|
|
// wallclock-deadline approach to simply retry until a timer elapses).
|
|
func retryEAGAIN[T any](fn func() (T, error)) (T, error) {
|
|
deadline := time.After(retryDeadline)
|
|
for {
|
|
v, err := fn()
|
|
if !errors.Is(err, unix.EAGAIN) {
|
|
return v, err
|
|
}
|
|
select {
|
|
case <-deadline:
|
|
return *new(T), fmt.Errorf("%v retry deadline exceeded: %w", retryDeadline, err)
|
|
default:
|
|
// retry
|
|
}
|
|
}
|
|
}
|
|
|
|
// retryEAGAIN2 is like retryEAGAIN except it returns two values.
|
|
func retryEAGAIN2[T1, T2 any](fn func() (T1, T2, error)) (T1, T2, error) {
|
|
type ret struct {
|
|
v1 T1
|
|
v2 T2
|
|
}
|
|
v, err := retryEAGAIN(func() (ret, error) {
|
|
v1, v2, err := fn()
|
|
return ret{v1: v1, v2: v2}, err
|
|
})
|
|
return v.v1, v.v2, err
|
|
}
|