The patch titled Subject: mm: check for SIGKILL inside dup_mmap() loop. has been added to the -mm tree. Its filename is mm-check-for-sigkill-inside-dup_mmap-loop.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/mm-check-for-sigkill-inside-dup_mmap-loop.patch and later at http://ozlabs.org/~akpm/mmotm/broken-out/mm-check-for-sigkill-inside-dup_mmap-loop.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx> Subject: mm: check for SIGKILL inside dup_mmap() loop. As a theoretical problem, dup_mmap() of an mm_struct with 60000+ vmas can loop while potentially allocating memory, with mm->mmap_sem held for write by current thread. This is bad if current thread was selected as an OOM victim, for current thread will continue allocations using memory reserves while OOM reaper is unable to reclaim memory. As an actually observable problem, it is not difficult to make OOM reaper unable to reclaim memory if the OOM victim is blocked at i_mmap_lock_write() in this loop. Unfortunately, since nobody can explain whether it is safe to use killable wait there, let's check for SIGKILL before trying to allocate memory. Even without an OOM event, there is no point with continuing the loop from the beginning if current thread is killed. Link: http://lkml.kernel.org/r/201804071938.CDE04681.SOFVQJFtMHOOLF@xxxxxxxxxxxxxxxxxxx Signed-off-by: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx> Cc: Alexander Viro <viro@xxxxxxxxxxxxxxxxxx> Cc: Rik van Riel <riel@xxxxxxxxxx> Cc: Michal Hocko <mhocko@xxxxxxxx> Cc: Kirill A. Shutemov <kirill.shutemov@xxxxxxxxxxxxxxx> Cc: David Rientjes <rientjes@xxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- kernel/fork.c | 4 ++++ 1 file changed, 4 insertions(+) diff -puN kernel/fork.c~mm-check-for-sigkill-inside-dup_mmap-loop kernel/fork.c --- a/kernel/fork.c~mm-check-for-sigkill-inside-dup_mmap-loop +++ a/kernel/fork.c @@ -440,6 +440,10 @@ static __latent_entropy int dup_mmap(str continue; } charge = 0; + if (fatal_signal_pending(current)) { + retval = -EINTR; + goto out; + } if (mpnt->vm_flags & VM_ACCOUNT) { unsigned long len = vma_pages(mpnt); _ Patches currently in -mm which might be from penguin-kernel@xxxxxxxxxxxxxxxxxxx are fs-elf-dont-complain-map_fixed_noreplace-unless-eexist-error.patch dentry-fix-kmemcheck-splat-at-take_dentry_name_snapshot.patch mm-check-for-sigkill-inside-dup_mmap-loop.patch mmvmscan-mark-register_shrinker-as-__must_check.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html