• Salman Qazi's avatar
    drivers/char/mem.c: avoid OOM lockup during large reads from /dev/zero · 730c586a
    Salman Qazi authored
    While running 20 parallel instances of dd as follows:
    
      #!/bin/bash
      for i in `seq 1 20`; do
               dd if=/dev/zero of=/export/hda3/dd_$i bs=1073741824 count=1 &
      done
      wait
    
    on a 16G machine, we noticed that rather than just killing the processes,
    the entire kernel went down.  Stracing dd reveals that it first does an
    mmap2, which makes 1GB worth of zero page mappings.  Then it performs a
    read on those pages from /dev/zero, and finally it performs a write.
    
    The machine died during the reads.  Looking at the code, it was noticed
    that /dev/zero's read operation had been changed by
    557ed1fa ("remove ZERO_PAGE") from giving
    zero page mappings to actually zeroing the page.
    
    The zeroing of the pages causes physical pages to be allocated to the
    process.  But, when the process exhausts all the memory that it can, the
    kernel cannot kill it, as it is still in the kernel mode allocating more
    memory.  Consequently, the kernel eventually crashes.
    
    To fix this, I propose that when a fatal signal is pending during
    /dev/zero read operation, we simply return and let the user process die.
    Signed-off-by: default avatarSalman Qazi <sqazi@google.com>
    Cc: Nick Piggin <nickpiggin@yahoo.com.au>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    [ Modified error return and comment trivially.  - Linus]
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    730c586a
mem.c 20.3 KB