From patchwork Wed Mar 9 00:25:50 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nico Pache X-Patchwork-Id: 12774511 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1F929C433EF for ; Wed, 9 Mar 2022 00:27:15 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id A137D8D0002; Tue, 8 Mar 2022 19:27:14 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 9C3318D0001; Tue, 8 Mar 2022 19:27:14 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 88A518D0002; Tue, 8 Mar 2022 19:27:14 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0048.hostedemail.com [216.40.44.48]) by kanga.kvack.org (Postfix) with ESMTP id 792BD8D0001 for ; Tue, 8 Mar 2022 19:27:14 -0500 (EST) Received: from smtpin28.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 2FA538248076 for ; Wed, 9 Mar 2022 00:27:14 +0000 (UTC) X-FDA: 79222958388.28.935B879 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by imf30.hostedemail.com (Postfix) with ESMTP id 9D3B280004 for ; Wed, 9 Mar 2022 00:27:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1646785633; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=IQnmFC1cuJST7emDApuALkwlrEbTx7n+o26OvtIZJos=; b=JN3DT1hryy+3R5Qbpiq2Wde1Ne9ETEzJI2+vGCZYRNrk+mYO53iL/Wi495mjoppnvPs4PD dtINQ38rXxGPC4SVR9KS8VhRHDOjbF3FgpYks1Afd9OqAAJr6xorNgZcviZ9sHb06nkPe3 DKIkkOywYt5hplLWga8k2QLLo36G8OE= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-465-kRPUGlnAMU20UWIWpsgLiA-1; Tue, 08 Mar 2022 19:27:09 -0500 X-MC-Unique: kRPUGlnAMU20UWIWpsgLiA-1 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id A488F1854E21; Wed, 9 Mar 2022 00:27:07 +0000 (UTC) Received: from localhost.localdomain.com (unknown [10.22.8.54]) by smtp.corp.redhat.com (Postfix) with ESMTP id B33AA62D4F; Wed, 9 Mar 2022 00:26:26 +0000 (UTC) From: Nico Pache To: linux-mm@kvack.org, linux-kernel@vger.kernel.org Cc: Rafael Aquini , Waiman Long , Baoquan He , Christoph von Recklinghausen , Don Dutile , "Herton R . Krzesinski" , David Rientjes , Michal Hocko , Andrea Arcangeli , Andrew Morton , tglx@linutronix.de, mingo@redhat.com, dvhart@infradead.org, dave@stgolabs.net, andrealmeid@collabora.com, peterz@infradead.org, Joel Savitz Subject: [PATCH v4] mm/oom_kill.c: futex: Don't OOM reap a process with a futex robust list Date: Tue, 8 Mar 2022 17:25:50 -0700 Message-Id: <20220309002550.103786-1-npache@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Rspam-User: X-Rspamd-Server: rspam02 X-Rspamd-Queue-Id: 9D3B280004 X-Stat-Signature: hm74pmw1firexhydisig138h4aafkeu1 Authentication-Results: imf30.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=JN3DT1hr; dmarc=pass (policy=none) header.from=redhat.com; spf=none (imf30.hostedemail.com: domain of npache@redhat.com has no SPF policy when checking 170.10.129.124) smtp.mailfrom=npache@redhat.com X-HE-Tag: 1646785633-203847 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: The pthread struct is allocated on PRIVATE|ANONYMOUS memory [1] which can be targeted by the oom reaper. This mapping is also used to store the futex robust list; the kernel does not keep a copy of the robust list and instead references a userspace address to maintain the robustness during a process death. A race can occur between exit_mm and the oom reaper that allows the oom reaper to clear the memory of the futex robust list before the exit path has handled the futex death. Prevent the OOM reaper from concurrently reaping the mappings if the dying process contains a robust_list. If the dying task_struct does not contain a pointer in tsk->robust_list, we can assume there was either never one setup for this task struct, or futex_cleanup has properly handled the futex death and we can safely reap this memory. Reproducer: https://gitlab.com/jsavitz/oom_futex_reproducer [1] https://elixir.bootlin.com/glibc/latest/source/nptl/allocatestack.c#L370 Fixes: 212925802454 ("mm: oom: let oom_reap_task and exit_mmap run concurrently") Cc: Rafael Aquini Cc: Waiman Long Cc: Baoquan He Cc: Christoph von Recklinghausen Cc: Don Dutile Cc: Herton R. Krzesinski Cc: David Rientjes Cc: Michal Hocko Cc: Andrea Arcangeli Cc: Andrew Morton Cc: Cc: Cc: Cc: Cc: Cc: Co-developed-by: Joel Savitz Signed-off-by: Joel Savitz Signed-off-by: Nico Pache --- mm/oom_kill.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/mm/oom_kill.c b/mm/oom_kill.c index 989f35a2bbb1..37af902494d8 100644 --- a/mm/oom_kill.c +++ b/mm/oom_kill.c @@ -587,6 +587,25 @@ static bool oom_reap_task_mm(struct task_struct *tsk, struct mm_struct *mm) goto out_unlock; } + /* Don't reap a process holding a robust_list as the pthread + * struct is allocated in userspace using PRIVATE | ANONYMOUS + * memory which when reaped before futex_cleanup() can leave + * the waiting process stuck. + */ +#ifdef CONFIG_FUTEX + bool robust = false; + + robust = tsk->robust_list != NULL; +#ifdef CONFIG_COMPAT + robust |= tsk->compat_robust_list != NULL; +#endif + if (robust) { + trace_skip_task_reaping(tsk->pid); + pr_info("oom_reaper: skipping task as it contains a robust list"); + goto out_finish; + } +#endif + trace_start_task_reaping(tsk->pid); /* failed to reap part of the address space. Try again later */