Merge branch 'for-4.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup

Pull cgroup updates from Tejun Heo:

 - a new PIDs controller is added.  It turns out that PIDs are actually
   an independent resource from kmem due to the limited PID space.

 - more core preparations for the v2 interface.  Once cpu side interface
   is settled, it should be ready for lifting the devel mask.
   for-4.3-unified-base was temporarily branched so that other trees
   (block) can pull cgroup core changes that blkcg changes depend on.

 - a non-critical idr_preload usage bug fix.

* 'for-4.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  cgroup: pids: fix invalid get/put usage
  cgroup: introduce cgroup_subsys->legacy_name
  cgroup: don't print subsystems for the default hierarchy
  cgroup: make cftype->private a unsigned long
  cgroup: export cgrp_dfl_root
  cgroup: define controller file conventions
  cgroup: fix idr_preload usage
  cgroup: add documentation for the PIDs controller
  cgroup: implement the PIDs subsystem
  cgroup: allow a cgroup subsystem to reject a fork

1 files changed, 16 insertions, 0 deletions

diff --git a/init/Kconfig b/init/Kconfig
index ba1e6eaf4c36..bb9b4dd55889 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -947,6 +947,22 @@ config CGROUP_FREEZER
           Provides a way to freeze and unfreeze all tasks in a
           cgroup.
 
+config CGROUP_PIDS
+        bool "PIDs cgroup subsystem"
+        help
+          Provides enforcement of process number limits in the scope of a
+          cgroup. Any attempt to fork more processes than is allowed in the
+          cgroup will fail. PIDs are fundamentally a global resource because it
+          is fairly trivial to reach PID exhaustion before you reach even a
+          conservative kmemcg limit. As a result, it is possible to grind a
+          system to halt without being limited by other cgroup policies. The
+          PIDs cgroup subsystem is designed to stop this from happening.
+
+          It should be noted that organisational operations (such as attaching
+          to a cgroup hierarchy will *not* be blocked by the PIDs subsystem),
+          since the PIDs limit only affects a process's ability to fork, not to
+          attach to a cgroup.
+
 config CGROUP_DEVICE
         bool "Device controller for cgroups"
         help