On Fri 14-06-19 20:15:31, Shakeel Butt wrote: > On Fri, Jun 14, 2019 at 6:08 PM syzbot > <syzbot+d0fc9d3c166bc5e4a94b@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote: > > > > Hello, > > > > syzbot found the following crash on: > > > > HEAD commit: 3f310e51 Add linux-next specific files for 20190607 > > git tree: linux-next > > console output: https://syzkaller.appspot.com/x/log.txt?x=15ab8771a00000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=5d176e1849bbc45 > > dashboard link: https://syzkaller.appspot.com/bug?extid=d0fc9d3c166bc5e4a94b > > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > > > Unfortunately, I don't have any reproducer for this crash yet. > > > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > > Reported-by: syzbot+d0fc9d3c166bc5e4a94b@xxxxxxxxxxxxxxxxxxxxxxxxx > > > > kasan: CONFIG_KASAN_INLINE enabled > > kasan: GPF could be caused by NULL-ptr deref or user memory access > > general protection fault: 0000 [#1] PREEMPT SMP KASAN > > CPU: 0 PID: 28426 Comm: syz-executor.5 Not tainted 5.2.0-rc3-next-20190607 > > #11 > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > > Google 01/01/2011 > > RIP: 0010:__read_once_size include/linux/compiler.h:194 [inline] > > RIP: 0010:has_intersects_mems_allowed mm/oom_kill.c:84 [inline] > > It seems like oom_unkillable_task() is broken for memcg OOMs. It > should not be calling has_intersects_mems_allowed() for memcg OOMs. You are right. It doesn't really make much sense to check for the NUMA policy/cpusets when the memcg oom is NUMA agnostic. Now that I am looking at the code then I am really wondering why do we even call oom_unkillable_task from oom_badness. proc_oom_score shouldn't care about NUMA either. In other words the following should fix this unless I am missing something (task_in_mem_cgroup seems to be a relict from before the group oom handling). But please note that I am still not fully operation and laying in the bed. diff --git a/mm/oom_kill.c b/mm/oom_kill.c index 5a58778c91d4..43eb479a5dc7 100644 --- a/mm/oom_kill.c +++ b/mm/oom_kill.c @@ -161,8 +161,8 @@ static bool oom_unkillable_task(struct task_struct *p, return true; /* When mem_cgroup_out_of_memory() and p is not member of the group */ - if (memcg && !task_in_mem_cgroup(p, memcg)) - return true; + if (memcg) + return false; /* p may not have freeable memory in nodemask */ if (!has_intersects_mems_allowed(p, nodemask)) @@ -318,7 +318,7 @@ static int oom_evaluate_task(struct task_struct *task, void *arg) struct oom_control *oc = arg; unsigned long points; - if (oom_unkillable_task(task, NULL, oc->nodemask)) + if (oom_unkillable_task(task, oc->memcg, oc->nodemask)) goto next; -- Michal Hocko SUSE Labs
