[<prev] [next>] [day] [month] [year] [list]
Message-Id: <20091111085345.FD21.A69D9226@jp.fujitsu.com>
Date: Wed, 11 Nov 2009 08:58:48 +0900 (JST)
From: KOSAKI Motohiro <kosaki.motohiro@...fujitsu.com>
To: David Rientjes <rientjes@...gle.com>
Cc: kosaki.motohiro@...fujitsu.com,
Andrew Morton <akpm@...ux-foundation.org>,
LKML <linux-kernel@...r.kernel.org>,
linux-mm <linux-mm@...ck.org>
Subject: Re: + oom-kill-show-virtual-size-and-rss-information-of-the-killed-process.patch added to -mm tree
(cc to linux-mm instead mm-commit)
> On Tue, 10 Nov 2009, akpm@...ux-foundation.org wrote:
>
> > diff -puN mm/oom_kill.c~oom-kill-show-virtual-size-and-rss-information-of-the-killed-process mm/oom_kill.c
> > --- a/mm/oom_kill.c~oom-kill-show-virtual-size-and-rss-information-of-the-killed-process
> > +++ a/mm/oom_kill.c
> > @@ -352,6 +352,8 @@ static void dump_header(gfp_t gfp_mask,
> > dump_tasks(mem);
> > }
> >
> > +#define K(x) ((x) << (PAGE_SHIFT-10))
> > +
> > /*
> > * Send SIGKILL to the selected process irrespective of CAP_SYS_RAW_IO
> > * flag though it's unlikely that we select a process with CAP_SYS_RAW_IO
> > @@ -371,9 +373,16 @@ static void __oom_kill_task(struct task_
> > return;
> > }
> >
> > - if (verbose)
> > - printk(KERN_ERR "Killed process %d (%s)\n",
> > - task_pid_nr(p), p->comm);
> > + if (verbose) {
> > + task_lock(p);
> > + printk(KERN_ERR "Killed process %d (%s) "
> > + "vsz:%lukB, anon-rss:%lukB, file-rss:%lukB\n",
> > + task_pid_nr(p), p->comm,
> > + K(p->mm->total_vm),
> > + K(get_mm_counter(p->mm, anon_rss)),
> > + K(get_mm_counter(p->mm, file_rss)));
> > + task_unlock(p);
> > + }
> >
> > /*
> > * We give our sacrificial lamb high priority and access to
>
> There's a race there which can dereference a NULL p->mm.
>
> p->mm is protected by task_lock(), but there's no check added here that
> ensures p->mm is still valid. The previous check for !p->mm in
> __oom_kill_task() is not protected by task_lock(), so there's a race:
>
> select_bad_process()
> oom_kill_process(p)
> do_exit()
> exit_signals(p) /* PF_EXITING */
> oom_kill_task(p)
> __oom_kill_task(p)
> exit_mm(p)
> task_lock(p)
> p->mm = NULL
> task_unlock(p)
> printk() of p->mm->total_vm
>
Nice catch!
> Please merge this as a fix.
>
> Signed-off-by: David Rientjes <rientjes@...gle.com>
> ---
> diff --git a/mm/oom_kill.c b/mm/oom_kill.c
> --- a/mm/oom_kill.c
> +++ b/mm/oom_kill.c
> @@ -367,22 +367,23 @@ static void __oom_kill_task(struct task_struct *p, int verbose)
> return;
> }
>
> + task_lock(p);
> if (!p->mm) {
> WARN_ON(1);
> - printk(KERN_WARNING "tried to kill an mm-less task!\n");
> + printk(KERN_WARNING "tried to kill an mm-less task %d (%s)!\n",
> + task_pid_nr(p), p->comm);
This adding pid and comm are you new feature.
I hope andrew remain your signed-off-by to merged patch.
otherthings, looks pretty godd to me.
Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@...fujitsu.com>
> + task_unlock(p);
> return;
> }
>
> - if (verbose) {
> - task_lock(p);
> + if (verbose)
> printk(KERN_ERR "Killed process %d (%s) "
> "vsz:%lukB, anon-rss:%lukB, file-rss:%lukB\n",
> task_pid_nr(p), p->comm,
> K(p->mm->total_vm),
> K(get_mm_counter(p->mm, anon_rss)),
> K(get_mm_counter(p->mm, file_rss)));
> - task_unlock(p);
> - }
> + task_unlock(p);
>
> /*
> * We give our sacrificial lamb high priority and access to
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists