Andrew notes that dereferencing task->comm is unsafe without holding
task_lock(task). That's true even when dealing with current, so all
existing dereferences within the oom killer need to ensure they are
holding task_lock() before doing so.
This avoids using get_task_comm() because we'd otherwise need to
allocate a string of TASK_COMM_LEN on the stack (or add synchronization
and use a global string) and we don't want to do that because page
allocations, and thus the oom killer, can happen particularly deep in the
stack.
Reported-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
Signed-off-by: David Rientjes <rientjes@xxxxxxxxxx>
---
mm/oom_kill.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -387,10 +387,10 @@ static void dump_tasks(const struct mem_cgroup *mem)
static void dump_header(struct task_struct *p, gfp_t gfp_mask, int order,
struct mem_cgroup *mem)
{
+ task_lock(current);
pr_warning("%s invoked oom-killer: gfp_mask=0x%x, order=%d, "
"oom_adj=%d\n",
current->comm, gfp_mask, order, current->signal->oom_adj);
- task_lock(current);
cpuset_print_task_mems_allowed(current);
task_unlock(current);
dump_stack();
@@ -443,8 +443,10 @@ static int oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order,
return 0;
}
+ task_lock(p);
pr_err("%s: Kill process %d (%s) score %lu or sacrifice child\n",
message, task_pid_nr(p), p->comm, points);
+ task_unlock(p);
/* Try to sacrifice the worst child first */
do_posix_clock_monotonic_gettime(&uptime);
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@xxxxxxxxxx For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>