enable CONFIG_MEMCG_KMEM

[Serge Hallyn]

CONFIG_MEMCG_KMEM is disabled in the trusty kernel. It's the recommended way to prevent forkbombs, so if there's not a good reason to have it disabled, it would be great if that could be changed.

[Tim Gardner (timg-tpi)]

Documentation/cgroups/memory.txt:

2.7 Kernel Memory Extension (CONFIG_MEMCG_KMEM)

With the Kernel memory extension, the Memory Controller is able to limit
the amount of kernel memory used by the system. Kernel memory is fundamentally
different than user memory, since it can't be swapped out, which makes it
possible to DoS the system by consuming too much of this precious resource.

Kernel memory won't be accounted at all until limit on a group is set. This
allows for existing setups to continue working without disruption. The limit
cannot be set if the cgroup have children, or if there are already tasks in the
cgroup. Attempting to set the limit under those conditions will return -EBUSY.
When use_hierarchy == 1 and a group is accounted, its children will
automatically be accounted regardless of their limit value.

After a group is first limited, it will be kept being accounted until it
is removed. The memory limitation itself, can of course be removed by writing
-1 to memory.kmem.limit_in_bytes. In this case, kmem will be accounted, but not
limited.

Kernel memory limits are not imposed for the root cgroup. Usage for the root
cgroup may or may not be accounted. The memory used is accumulated into
memory.kmem.usage_in_bytes, or in a separate counter when it makes sense.
(currently only for tcp).
The main "kmem" counter is fed into the main counter, so kmem charges will
also be visible from the user counter.

Currently no soft limit is implemented for kernel memory. It is future work
to trigger slab reclaim when those limits are reached.

[Brad Figg (brad-figg)]

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-trusty' to 'verification-done-trusty'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Tim Gardner (timg-tpi)]

Marking verification-done-trusty as this was a config change.

debian.master/config/config.common.ubuntu:CONFIG_MEMCG_KMEM=y

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.13.0-27.50

---------------
linux (3.13.0-27.50) trusty; urgency=low

  [ Brad Figg ]

  * Revert "rtlwifi: Set the link state"

linux (3.13.0-27.49) trusty; urgency=low

  [ Brad Figg ]

  * Revert "SAUCE: (no-up) HID: rmi: do not stop the device at the end of
    probe"
  * Revert "SAUCE: (no-up) HID: rmi: introduce RMI driver for Synaptics
    touchpads"
  * Revert "[Config] CONFIG_HID_RMI=m"

linux (3.13.0-26.48) trusty; urgency=low

  [ Benjamin Tissoires ]

  * SAUCE: (no-up) HID: rmi: introduce RMI driver for Synaptics touchpads
    - LP: #1305522
  * SAUCE: (no-up) HID: rmi: do not stop the device at the end of probe
    - LP: #1305522

  [ Kamal Mostafa ]

  * Merged back Ubuntu-3.13.0-24.47 security release
  * Revert "n_tty: Fix n_tty_write crash when echoing in raw mode"
    - LP: #1314762
  * Release Tracking Bug
    - LP: #1316835

  [ Tim Gardner ]

  * [Config] CONFIG_HID_RMI=m
    - LP: #1305522
  * [Config] CONFIG_CRYPTO_DEV_NX=n for ppc64el
    - LP: #1314625
  * [Config] CONFIG_ZSWAP=y
    - LP: #1315203
  * Add rpcsec_gss_krb5 to generic inclusion list
    - LP: #769527

  [ Upstream Kernel Changes ]

  * HID: hidraw: make comment more accurate and nicer
    - LP: #1305522
  * HID: remove hid_get_raw_report in struct hid_device
    - LP: #1305522
  * HID: i2c-hid: implement ll_driver transport-layer callbacks
    - LP: #1305522
  * HID: add inliners for ll_driver transport-layer callbacks
    - LP: #1305522
  * HID: Add transport-driver callbacks to the hid_ll_driver struct
    - LP: #1305522
  * drm/nouveau: fail runtime pm properly.
    - LP: #1313986
  * drm/nouveau: don't suspend/resume display on runtime s/r
    - LP: #1313986
  * n_tty: Fix n_tty_write crash when echoing in raw mode
    - LP: #1314762
    - CVE-2014-0196
  * floppy: ignore kernel-only members in FDRAWCMD ioctl input
    - LP: #1316729
    - CVE-2014-1737
  * floppy: don't write kernel-only members to FDRAWCMD ioctl output
    - LP: #1316735
    - CVE-2014-1738

linux (3.13.0-25.47) trusty; urgency=low

  [ Joseph Salisbury ]

  * Release Tracking Bug
    - LP: #1313868

  [ Adam Lee ]

  * [Config] CONFIG_RTL8723BE=m, CONFIG_RTL8723_COMMON=m
    - LP: #1240940

  [ Alex Hung ]

  * SAUCE: (no-up) dell-led: add mic mute led interface
    - LP: #1308297

  [ Andy Whitcroft ]

  * SAUCE: (no-up) powerpc: Increase COMMAND_LINE_SIZE to 2048 from 512.
    - LP: #1306677

  [ Ben Collins ]

  * [Config] Disable PAMU on Freescale kernels
    - LP: #1311738

  [ Tim Gardner ]

  * Revert "SAUCE: x86, hyperv: bypass the timer_irq_works() check"
    - LP: #1311683
  * SAUCE: (no-up) ALSA: usb-audio: Suppress repetitive debug messages from
    retire_playback_urb()
    - LP: #1305133
  * SAUCE: (no-up) 'BUG:' message unnecessarily triggers kerneloops
    - LP: #1305480
  * [Config] CONFIG_POWERNV_CPUFREQ=m
    - LP: #1309576
  * [Config] CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y for ppc64el
    - LP: #1309576
  * [Config] CONFIG_TRANSPARENT_HUGEPAGE=n for arm64
    - LP: #1309221
  * [Config] CONFIG_MEMCG_KMEM=y
    - LP: #1309586
  * [Config] CONFIG_CRASH_DUMP=y for ppc64el
    - LP: #1312783

  [ Upstream Kernel Change...