From nobody Tue Jun 23 08:03:52 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CD3DEC4167D for ; Wed, 9 Mar 2022 01:08:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229849AbiCIBJw (ORCPT ); Tue, 8 Mar 2022 20:09:52 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46148 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230208AbiCIBHy (ORCPT ); Tue, 8 Mar 2022 20:07:54 -0500 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 22491141478 for ; Tue, 8 Mar 2022 16:48:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1646786923; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=IQnmFC1cuJST7emDApuALkwlrEbTx7n+o26OvtIZJos=; b=KltD8UMensiSkeHYcaOkSA0myDEmaOi1iZ7qL1FXZUji8uHPjfUgrNsDDkmbnrBbjPerKI b79vODSJZ/OgZKYvMPlnXJjFt5ByUbQ/4iX4DZa6Byi4PbbI4tMjXfEOfgYW244ciMHFyM 98uS98lcS/cfZsSo8wQnSM42pceEFJk= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-465-kRPUGlnAMU20UWIWpsgLiA-1; Tue, 08 Mar 2022 19:27:09 -0500 X-MC-Unique: kRPUGlnAMU20UWIWpsgLiA-1 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id A488F1854E21; Wed, 9 Mar 2022 00:27:07 +0000 (UTC) Received: from localhost.localdomain.com (unknown [10.22.8.54]) by smtp.corp.redhat.com (Postfix) with ESMTP id B33AA62D4F; Wed, 9 Mar 2022 00:26:26 +0000 (UTC) From: Nico Pache To: linux-mm@kvack.org, linux-kernel@vger.kernel.org Cc: Rafael Aquini , Waiman Long , Baoquan He , Christoph von Recklinghausen , Don Dutile , "Herton R . Krzesinski" , David Rientjes , Michal Hocko , Andrea Arcangeli , Andrew Morton , tglx@linutronix.de, mingo@redhat.com, dvhart@infradead.org, dave@stgolabs.net, andrealmeid@collabora.com, peterz@infradead.org, Joel Savitz Subject: [PATCH v4] mm/oom_kill.c: futex: Don't OOM reap a process with a futex robust list Date: Tue, 8 Mar 2022 17:25:50 -0700 Message-Id: <20220309002550.103786-1-npache@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" The pthread struct is allocated on PRIVATE|ANONYMOUS memory [1] which can be targeted by the oom reaper. This mapping is also used to store the futex robust list; the kernel does not keep a copy of the robust list and instead references a userspace address to maintain the robustness during a process death. A race can occur between exit_mm and the oom reaper that allows the oom reaper to clear the memory of the futex robust list before the exit path has handled the futex death. Prevent the OOM reaper from concurrently reaping the mappings if the dying process contains a robust_list. If the dying task_struct does not contain a pointer in tsk->robust_list, we can assume there was either never one setup for this task struct, or futex_cleanup has properly handled the futex death and we can safely reap this memory. Reproducer: https://gitlab.com/jsavitz/oom_futex_reproducer [1] https://elixir.bootlin.com/glibc/latest/source/nptl/allocatestack.c#L370 Fixes: 212925802454 ("mm: oom: let oom_reap_task and exit_mmap run concurre= ntly") Cc: Rafael Aquini Cc: Waiman Long Cc: Baoquan He Cc: Christoph von Recklinghausen Cc: Don Dutile Cc: Herton R. Krzesinski Cc: David Rientjes Cc: Michal Hocko Cc: Andrea Arcangeli Cc: Andrew Morton Cc: Cc: Cc: Cc: Cc: Cc: Co-developed-by: Joel Savitz Signed-off-by: Joel Savitz Signed-off-by: Nico Pache --- mm/oom_kill.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/mm/oom_kill.c b/mm/oom_kill.c index 989f35a2bbb1..37af902494d8 100644 --- a/mm/oom_kill.c +++ b/mm/oom_kill.c @@ -587,6 +587,25 @@ static bool oom_reap_task_mm(struct task_struct *tsk, = struct mm_struct *mm) goto out_unlock; } =20 + /* Don't reap a process holding a robust_list as the pthread + * struct is allocated in userspace using PRIVATE | ANONYMOUS + * memory which when reaped before futex_cleanup() can leave + * the waiting process stuck. + */ +#ifdef CONFIG_FUTEX + bool robust =3D false; + + robust =3D tsk->robust_list !=3D NULL; +#ifdef CONFIG_COMPAT + robust |=3D tsk->compat_robust_list !=3D NULL; +#endif + if (robust) { + trace_skip_task_reaping(tsk->pid); + pr_info("oom_reaper: skipping task as it contains a robust list"); + goto out_finish; + } +#endif + trace_start_task_reaping(tsk->pid); =20 /* failed to reap part of the address space. Try again later */ --=20 2.35.1