lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 11 Nov 2009 08:58:48 +0900 (JST) From: KOSAKI Motohiro <kosaki.motohiro@...fujitsu.com> To: David Rientjes <rientjes@...gle.com> Cc: kosaki.motohiro@...fujitsu.com, Andrew Morton <akpm@...ux-foundation.org>, LKML <linux-kernel@...r.kernel.org>, linux-mm <linux-mm@...ck.org> Subject: Re: + oom-kill-show-virtual-size-and-rss-information-of-the-killed-process.patch added to -mm tree (cc to linux-mm instead mm-commit) > On Tue, 10 Nov 2009, akpm@...ux-foundation.org wrote: > > > diff -puN mm/oom_kill.c~oom-kill-show-virtual-size-and-rss-information-of-the-killed-process mm/oom_kill.c > > --- a/mm/oom_kill.c~oom-kill-show-virtual-size-and-rss-information-of-the-killed-process > > +++ a/mm/oom_kill.c > > @@ -352,6 +352,8 @@ static void dump_header(gfp_t gfp_mask, > > dump_tasks(mem); > > } > > > > +#define K(x) ((x) << (PAGE_SHIFT-10)) > > + > > /* > > * Send SIGKILL to the selected process irrespective of CAP_SYS_RAW_IO > > * flag though it's unlikely that we select a process with CAP_SYS_RAW_IO > > @@ -371,9 +373,16 @@ static void __oom_kill_task(struct task_ > > return; > > } > > > > - if (verbose) > > - printk(KERN_ERR "Killed process %d (%s)\n", > > - task_pid_nr(p), p->comm); > > + if (verbose) { > > + task_lock(p); > > + printk(KERN_ERR "Killed process %d (%s) " > > + "vsz:%lukB, anon-rss:%lukB, file-rss:%lukB\n", > > + task_pid_nr(p), p->comm, > > + K(p->mm->total_vm), > > + K(get_mm_counter(p->mm, anon_rss)), > > + K(get_mm_counter(p->mm, file_rss))); > > + task_unlock(p); > > + } > > > > /* > > * We give our sacrificial lamb high priority and access to > > There's a race there which can dereference a NULL p->mm. > > p->mm is protected by task_lock(), but there's no check added here that > ensures p->mm is still valid. The previous check for !p->mm in > __oom_kill_task() is not protected by task_lock(), so there's a race: > > select_bad_process() > oom_kill_process(p) > do_exit() > exit_signals(p) /* PF_EXITING */ > oom_kill_task(p) > __oom_kill_task(p) > exit_mm(p) > task_lock(p) > p->mm = NULL > task_unlock(p) > printk() of p->mm->total_vm > Nice catch! > Please merge this as a fix. > > Signed-off-by: David Rientjes <rientjes@...gle.com> > --- > diff --git a/mm/oom_kill.c b/mm/oom_kill.c > --- a/mm/oom_kill.c > +++ b/mm/oom_kill.c > @@ -367,22 +367,23 @@ static void __oom_kill_task(struct task_struct *p, int verbose) > return; > } > > + task_lock(p); > if (!p->mm) { > WARN_ON(1); > - printk(KERN_WARNING "tried to kill an mm-less task!\n"); > + printk(KERN_WARNING "tried to kill an mm-less task %d (%s)!\n", > + task_pid_nr(p), p->comm); This adding pid and comm are you new feature. I hope andrew remain your signed-off-by to merged patch. otherthings, looks pretty godd to me. Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@...fujitsu.com> > + task_unlock(p); > return; > } > > - if (verbose) { > - task_lock(p); > + if (verbose) > printk(KERN_ERR "Killed process %d (%s) " > "vsz:%lukB, anon-rss:%lukB, file-rss:%lukB\n", > task_pid_nr(p), p->comm, > K(p->mm->total_vm), > K(get_mm_counter(p->mm, anon_rss)), > K(get_mm_counter(p->mm, file_rss))); > - task_unlock(p); > - } > + task_unlock(p); > > /* > * We give our sacrificial lamb high priority and access to -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists