From: "Kohli, Gaurav" <gkohli@codeaurora.org>
To: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>, rientjes@google.com
Cc: akpm@linux-foundation.org, mhocko@suse.com,
kirill.shutemov@linux.intel.com, aarcange@redhat.com,
linux-mm@kvack.org, linux-kernel@vger.kernel.org,
linux-arm-msm@vger.kernel.org
Subject: Re: [PATCH] mm: oom: Fix race condition between oom_badness and do_exit of task
Date: Fri, 9 Mar 2018 17:34:39 +0530 [thread overview]
Message-ID: <c3b8dd2a-2636-2ce1-f7e7-c78a43608be1@codeaurora.org> (raw)
In-Reply-To: <201803091948.FBC21396.LHOMSFFOVFtQJO@I-love.SAKURA.ne.jp>
On 3/9/2018 4:18 PM, Tetsuo Handa wrote:
> Kohli, Gaurav wrote:
>>> t->alloc_lock is still held when leaving find_lock_task_mm(), which means
>>> that t->mm != NULL. But nothing prevents t from setting t->mm = NULL at
>>> exit_mm() from do_exit() and calling exit_creds() from __put_task_struct(t)
>>> after task_unlock(t) is called. Seems difficult to trigger race window. Maybe
>>> something has preempted because oom_badness() becomes outside of RCU grace
>>> period upon leaving find_lock_task_mm() when called from proc_oom_score().
>> Hi Tetsuo,
>>
>> Yes it is not easy to reproduce seen twice till now and i agree with
>> your analysis. But David has already fixing this in different way,
>> So that also looks better to me:
>>
>> https://patchwork.kernel.org/patch/10265641/
>>
> Yes, I'm aware of that patch.
>
>> But if need to keep that code, So we have to bump up the task
>> reference that's only i can think of now.
> I don't think so, for I think it is safe to call
> has_capability_noaudit(p) with p->alloc_lock held.
>
> diff --git a/mm/oom_kill.c b/mm/oom_kill.c
> index f2e7dfb..4efcfb8 100644
> --- a/mm/oom_kill.c
> +++ b/mm/oom_kill.c
> @@ -222,7 +222,6 @@ unsigned long oom_badness(struct task_struct *p, struct mem_cgroup *memcg,
> */
> points = get_mm_rss(p->mm) + get_mm_counter(p->mm, MM_SWAPENTS) +
> mm_pgtables_bytes(p->mm) / PAGE_SIZE;
> - task_unlock(p);
>
> /*
> * Root processes get 3% bonus, just like the __vm_enough_memory()
> @@ -230,6 +229,7 @@ unsigned long oom_badness(struct task_struct *p, struct mem_cgroup *memcg,
> */
> if (has_capability_noaudit(p, CAP_SYS_ADMIN))
> points -= (points * 3) / 100;
> + task_unlock(p);
Earlier i have thought the same to post this, but this may create
problem if there are sleeping calls in
has_capability_noaudit ?
>
> /* Normalize to oom_score_adj units */
> adj *= totalpages / 1000;
>
--
Qualcomm India Private Limited, on behalf of Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project.
next prev parent reply other threads:[~2018-03-09 12:04 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-07 12:57 [PATCH] mm: oom: Fix race condition between oom_badness and do_exit of task Gaurav Kohli
2018-03-07 20:56 ` David Rientjes
2018-03-08 4:51 ` Kohli, Gaurav
2018-03-08 14:05 ` Tetsuo Handa
[not found] ` <14ba6c44-d444-bd0a-0bac-0c6851b19344@codeaurora.org>
2018-03-09 10:48 ` Tetsuo Handa
2018-03-09 12:04 ` Kohli, Gaurav [this message]
2018-03-09 12:18 ` Tetsuo Handa
2018-03-13 13:37 ` Michal Hocko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c3b8dd2a-2636-2ce1-f7e7-c78a43608be1@codeaurora.org \
--to=gkohli@codeaurora.org \
--cc=aarcange@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=kirill.shutemov@linux.intel.com \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mhocko@suse.com \
--cc=penguin-kernel@I-love.SAKURA.ne.jp \
--cc=rientjes@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).