Commit 880b7689 authored by Tetsuo Handa's avatar Tetsuo Handa Committed by Linus Torvalds

mm/oom_kill.c: fix potentially killing unrelated process

At the for_each_process() loop in oom_kill_process(), we are comparing
address of OOM victim's mm without holding a reference to that mm.  If
there are a lot of processes to compare or a lot of "Kill process %d (%s)
sharing same memory" messages to print, for_each_process() loop could take
very long time.

It is possible that meanwhile the OOM victim exits and releases its mm,
and then mm is allocated with the same address and assigned to some
unrelated process.  When we hit such race, the unrelated process will be
killed by error.  To make sure that the OOM victim's mm does not go away
until for_each_process() loop finishes, get a reference on the OOM
victim's mm before calling task_unlock(victim).

[oleg@redhat.com: several fixes]
Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: default avatarMichal Hocko <mhocko@suse.com>
Cc: David Rientjes <rientjes@google.com>
Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 426fb5e7
...@@ -552,8 +552,9 @@ void oom_kill_process(struct oom_control *oc, struct task_struct *p, ...@@ -552,8 +552,9 @@ void oom_kill_process(struct oom_control *oc, struct task_struct *p,
victim = p; victim = p;
} }
/* mm cannot safely be dereferenced after task_unlock(victim) */ /* Get a reference to safely compare mm after task_unlock(victim) */
mm = victim->mm; mm = victim->mm;
atomic_inc(&mm->mm_count);
/* /*
* We should send SIGKILL before setting TIF_MEMDIE in order to prevent * We should send SIGKILL before setting TIF_MEMDIE in order to prevent
* the OOM victim from depleting the memory reserves from the user * the OOM victim from depleting the memory reserves from the user
...@@ -591,6 +592,7 @@ void oom_kill_process(struct oom_control *oc, struct task_struct *p, ...@@ -591,6 +592,7 @@ void oom_kill_process(struct oom_control *oc, struct task_struct *p,
} }
rcu_read_unlock(); rcu_read_unlock();
mmdrop(mm);
put_task_struct(victim); put_task_struct(victim);
} }
#undef K #undef K
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment