[PATCH net-next v3 0/5] netconsole: Support messages ratelimit-ing

[Breno Leitao]

netconsole hands every console message to every enabled target, with no
bound on the rate.

At Meta, a few hosts caused some DoS and netconsd was OOM killed in
some regions, fed by 3 billion RCU messages from thousand hosts and by
a swap fault that retries forever, which logged 6 million copies of one
line on a single host in a few hours.

Both floods are being fixed where they are printed, by Paul and me for RCU
Tasks [1][2] and by me for the swap fault fix [3], but that only ever
covers the flood already found, not new issues that might be happening.

Use the ratelimit in the kernel to ratelimit messages from netconsole.

Give each target a token bucket, consulted once per message so that a
message split into several ncfrag packets is sent whole or dropped
whole.

It starts with a zero interval, which struct ratelimit_state treats as
unlimited, so nothing changes until ratelimit_interval_ms and
ratelimit_burst are written.

What the bucket discards leaves nothing on the wire. An extended target
sees the loss as a gap in the sequence number the header carries:

	7.2.0-rc7-01460-g75848acaf136,13,628,252392647,-;netconsole selftest: netcons_AGujw 1
	7.2.0-rc7-01460-g75848acaf136,13,629,252392782,-;netconsole selftest: netcons_AGujw 2
	7.2.0-rc7-01460-g75848acaf136,13,678,254742125,-;netconsole selftest: netcons_AGujw 1

Crash output is exempt. The bucket is skipped once
netconsole_kernel_dying() is true, which the first patch adds:
oops_in_progress covers panic(), TAINT_DIE covers an oops or a BUG(),
whose records only reach netconsole from the printer thread, after
oops_end() cleared the flag.

A target that has seen the kernel die stays unlimited until reboot.

[1] https://lore.kernel.org/all/anw8Qw8lfeIykski@xxxxxxxxx/
[2] https://lore.kernel.org/all/20260810-rcu_task_shrink_lruvec-v1-1-4d9f7d5251cb@xxxxxxxxxx/
[3] https://lore.kernel.org/all/20260813-swap-v2-0-4a625ccabdae@xxxxxxxxxx/

Signed-off-by: Breno Leitao <leitao@xxxxxxxxxx>
---
Changes in v3:
- New first patch, a fix that stands on its own: oops_only=1 receives
  nothing on an oops today, because the backtrace reaches netconsole
  from the printer thread, after oops_end() cleared oops_in_progress.
  It tests TAINT_DIE too, behind netconsole_kernel_dying(), which the
  bucket then reuses so that a limit cannot truncate a crash either.
  (Sashiko)
- Restart the interval when either knob is written. A target is
  configured while it floods, with the bucket already empty, and the
  new limit only applied one interval later. (Sashiko)
- Reject an interval above INT_MAX ms. msecs_to_jiffies() saturates
  below INT_MAX on 32-bit, so checking the jiffies value alone took a
  write there that a 64-bit kernel turns down. (Sashiko)
- List both files in the target parameter table, and qualify the rule
  underneath it, which says that only a disabled target can be updated.
  (Sashiko)
- Link to v2: https://patch.msgid.link/20260910-netcons_ratelimit-v2-0-ebf0dd91e26e@xxxxxxxxxx

Changes in v2:
- Drop the patch that sent a "N messages dropped by rate limit" notice
  to the target. (Gustavo Luiz Duarte).
- Link to v1: https://patch.msgid.link/20260818-netcons_ratelimit-v1-0-8c5d2d17789c@xxxxxxxxxx

---
Breno Leitao (5):
      netconsole: send the oops when oops_only is set
      netconsole: add a per-target message rate limit
      netconsole: allow configuring the rate limit interval through configfs
      netconsole: allow configuring the rate limit burst through configfs
      docs: netconsole: document rate limit feature

 Documentation/networking/netconsole.rst |  71 ++++++++++++++----
 drivers/net/netconsole.c                | 126 +++++++++++++++++++++++++++++++-
 2 files changed, 181 insertions(+), 16 deletions(-)
---
base-commit: c68a982815dcce5464e3bf2a31ac94f5146c04ca
change-id: 20260817-netcons_ratelimit-629b04a73c57

Best regards,
--  
Breno Leitao <leitao@xxxxxxxxxx>