linux-kernel - Re: Improving OOM killer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 4 Feb 2010 14:53:32 -0800 (PST)
From:	David Rientjes <rientjes@...gle.com>
To:	Frans Pop <elendil@...net.nl>
cc:	Rik van Riel <riel@...hat.com>, l.lunak@...e.cz,
	Balbir Singh <balbir@...ux.vnet.ibm.com>, linux-mm@...ck.org,
	linux-kernel@...r.kernel.org,
	Andrew Morton <akpm@...ux-foundation.org>,
	KOSAKI Motohiro <kosaki.motohiro@...fujitsu.com>,
	Nick Piggin <npiggin@...e.de>, jkosina@...e.cz
Subject: Re: Improving OOM killer

On Thu, 4 Feb 2010, Frans Pop wrote:

> Shouldn't fork bomb detection take into account the age of children?
> After all, long running processes with a lot of long running children are 
> rather unlikely to be runaway fork _bombs_.
> 

Yeah, Lubos mentioned using cpu time as a requirement, in addition to the 
already existing child->mm != parent->mm, as a prerequisite to be added 
into the tally to check the forkbomb threshold.  I think something like 
this would be appropriate:

	struct task_cputime task_time;
	int forkcount = 0;
	int child_rss = 0;

	...

	list_for_each_entry(child, &p->children, sibling) {
		unsigned long runtime;

		task_lock(child);
		if (!child->mm || child->mm == p->mm) {
			task_unlock(child);
			continue;
		}
		thread_group_cputime(child, &task_time);
		runtime = cputime_to_jiffies(task_time.utime) +
				cputime_to_jiffies(task_time.stime);

		/*
		 * Only threads that have run for less than a second are
		 * considered toward the forkbomb, these threads rarely
		 * get to execute at all in such cases anyway.
		 */
		if (runtime < HZ) {
			task_unlock(child);
			continue;
		}
		child_rss += get_mm_rss(child->mm);
		forkcount++;
	}

	if (forkcount > sysctl_oom_forkbomb_thres) {
		/*
		 * Penalize forkbombs by considering the average rss and
		 * how many factors we are over the threshold.
		 */
		points += child_rss / sysctl_oom_forkbomb_thres;
	}

I changed the calculation from lowest child rss to average child rss, so 
this is functionally equivalent to

(average rss size of children) * (# of first-generated execve children) /
			sysctl_oom_forkbomb_thres
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/