oom: introduce find_lock_task_mm() to fix !mm false positives

Almost all ->mm == NULL checks in oom_kill.c are wrong.

The current code assumes that the task without ->mm has already released
its memory and ignores the process.  However this is not necessarily true
when this process is multithreaded, other live sub-threads can use this
->mm.

- Remove the "if (!p->mm)" check in select_bad_process(), it is
  just wrong.

- Add the new helper, find_lock_task_mm(), which finds the live
  thread which uses the memory and takes task_lock() to pin ->mm

- change oom_badness() to use this helper instead of just checking
  ->mm != NULL.

- As David pointed out, select_bad_process() must never choose the
  task without ->mm, but no matter what oom_badness() returns the
  task can be chosen if nothing else has been found yet.

  Change oom_badness() to return int, change it to return -1 if
  find_lock_task_mm() fails, and change select_bad_process() to
  check points >= 0.

Note! This patch is not enough, we need more changes.

	- oom_badness() was fixed, but oom_kill_task() still ignores
	  the task without ->mm

	- oom_forkbomb_penalty() should use find_lock_task_mm() too,
	  and it also needs other changes to actually find the first
	  first-descendant children

This will be addressed later.

[kosaki.motohiro@jp.fujitsu.com: use in badness(), __oom_kill_task()]
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: David Rientjes <rientjes@google.com>
Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 43 insertions, 31 deletions

diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 0a6e466155d2..9a686aa35a48 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -52,6 +52,20 @@ static int has_intersects_mems_allowed(struct task_struct *tsk)
         return 0;
 }
 
+static struct task_struct *find_lock_task_mm(struct task_struct *p)
+{
+        struct task_struct *t = p;
+
+        do {
+                task_lock(t);
+                if (likely(t->mm))
+                        return t;
+                task_unlock(t);
+        } while_each_thread(p, t);
+
+        return NULL;
+}
+
 /**
  * badness - calculate a numeric value for how bad this task has been
  * @p: task struct of which task we should calculate
@@ -74,8 +88,8 @@ static int has_intersects_mems_allowed(struct task_struct *tsk)
 unsigned long badness(struct task_struct *p, unsigned long uptime)
 {
         unsigned long points, cpu_time, run_time;
-        struct mm_struct *mm;
         struct task_struct *child;
+        struct task_struct *c, *t;
         int oom_adj = p->signal->oom_adj;
         struct task_cputime task_time;
         unsigned long utime;
@@ -84,17 +98,14 @@ unsigned long badness(struct task_struct *p, unsigned long uptime)
         if (oom_adj == OOM_DISABLE)
                 return 0;
 
-        task_lock(p);
-        mm = p->mm;
-        if (!mm) {
-                task_unlock(p);
+        p = find_lock_task_mm(p);
+        if (!p)
                 return 0;
-        }
 
         /*
          * The memory size of the process is the basis for the badness.
          */
-        points = mm->total_vm;
+        points = p->mm->total_vm;
 
         /*
          * After this unlock we can no longer dereference local variable `mm'
@@ -115,12 +126,17 @@ unsigned long badness(struct task_struct *p, unsigned long uptime)
          * child is eating the vast majority of memory, adding only half
          * to the parents will make the child our kill candidate of choice.
          */
-        list_for_each_entry(child, &p->children, sibling) {
-                task_lock(child);
-                if (child->mm != mm && child->mm)
-                        points += child->mm->total_vm/2 + 1;
-                task_unlock(child);
-        }
+        t = p;
+        do {
+                list_for_each_entry(c, &t->children, sibling) {
+                        child = find_lock_task_mm(c);
+                        if (child) {
+                                if (child->mm != p->mm)
+                                        points += child->mm->total_vm/2 + 1;
+                                task_unlock(child);
+                        }
+                }
+        } while_each_thread(p, t);
 
         /*
          * CPU time is in tens of seconds and run time is in thousands
@@ -256,9 +272,6 @@ static struct task_struct *select_bad_process(unsigned long *ppoints,
         for_each_process(p) {
                 unsigned long points;
 
-                /* skip tasks that have already released their mm */
-                if (!p->mm)
-                        continue;
                 /* skip the init task and kthreads */
                 if (is_global_init(p) || (p->flags & PF_KTHREAD))
                         continue;
@@ -385,14 +398,9 @@ static void __oom_kill_task(struct task_struct *p, int verbose)
                 return;
         }
 
-        task_lock(p);
-        if (!p->mm) {
-                WARN_ON(1);
-                printk(KERN_WARNING "tried to kill an mm-less task %d (%s)!\n",
-                        task_pid_nr(p), p->comm);
-                task_unlock(p);
+        p = find_lock_task_mm(p);
+        if (!p)
                 return;
-        }
 
         if (verbose)
                 printk(KERN_ERR "Killed process %d (%s) "
@@ -437,6 +445,7 @@ static int oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order,
                             const char *message)
 {
         struct task_struct *c;
+        struct task_struct *t = p;
 
         if (printk_ratelimit())
                 dump_header(p, gfp_mask, order, mem);
@@ -454,14 +463,17 @@ static int oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order,
                                         message, task_pid_nr(p), p->comm, points);
 
         /* Try to kill a child first */
-        list_for_each_entry(c, &p->children, sibling) {
-                if (c->mm == p->mm)
-                        continue;
-                if (mem && !task_in_mem_cgroup(c, mem))
-                        continue;
-                if (!oom_kill_task(c))
-                        return 0;
-        }
+        do {
+                list_for_each_entry(c, &t->children, sibling) {
+                        if (c->mm == p->mm)
+                                continue;
+                        if (mem && !task_in_mem_cgroup(c, mem))
+                                continue;
+                        if (!oom_kill_task(c))
+                                return 0;
+                }
+        } while_each_thread(p, t);
+
         return oom_kill_task(p);
 }