Nico Pache 4fbac33deb oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup ... commit e4a38402c3 upstream. The pthread struct is allocated on PRIVATE|ANONYMOUS memory [1] which can be targeted by the oom reaper. This mapping is used to store the futex robust list head; the kernel does not keep a copy of the robust list and instead references a userspace address to maintain the robustness during a process death. A race can occur between exit_mm and the oom reaper that allows the oom reaper to free the memory of the futex robust list before the exit path has handled the futex death: CPU1 CPU2 -------------------------------------------------------------------- page_fault do_exit "signal" wake_oom_reaper oom_reaper oom_reap_task_mm (invalidates mm) exit_mm exit_mm_release futex_exit_release futex_cleanup exit_robust_list get_user (EFAULT- can't access memory) If the get_user EFAULT's, the kernel will be unable to recover the waiters on the robust_list, leaving userspace mutexes hung indefinitely. Delay the OOM reaper, allowing more time for the exit path to perform the futex cleanup. Reproducer: https://gitlab.com/jsavitz/oom_futex_reproducer Based on a patch by Michal Hocko. Link: https://elixir.bootlin.com/glibc/glibc-2.35/source/nptl/allocatestack.c#L370 [1] Link: https://lkml.kernel.org/r/20220414144042.677008-1-npache@redhat.com Fixes: 2129258024 ("mm: oom: let oom_reap_task and exit_mmap run concurrently") Signed-off-by: Joel Savitz <jsavitz@redhat.com> Signed-off-by: Nico Pache <npache@redhat.com> Co-developed-by: Joel Savitz <jsavitz@redhat.com> Suggested-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Michal Hocko <mhocko@suse.com> Cc: Rafael Aquini <aquini@redhat.com> Cc: Waiman Long <longman@redhat.com> Cc: Herton R. Krzesinski <herton@redhat.com> Cc: Juri Lelli <juri.lelli@redhat.com> Cc: Vincent Guittot <vincent.guittot@linaro.org> Cc: Dietmar Eggemann <dietmar.eggemann@arm.com> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Ben Segall <bsegall@google.com> Cc: Mel Gorman <mgorman@suse.de> Cc: Daniel Bristot de Oliveira <bristot@redhat.com> Cc: David Rientjes <rientjes@google.com> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: Davidlohr Bueso <dave@stgolabs.net> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Ingo Molnar <mingo@redhat.com> Cc: Joel Savitz <jsavitz@redhat.com> Cc: Darren Hart <dvhart@infradead.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-04-27 14:41:11 +02:00
..
acpi
asm-generic	tlb: hugetlb: Add more sizes to tlb_remove_huge_tlb_entry	2022-04-20 09:36:21 +02:00
clocksource
crypto	lib/crypto: blake2s: avoid indirect calls to compression function for Clang CFI	2022-02-04 19:22:32 +01:00
drm	drm/connector: Fix typo in documentation	2022-04-08 13:58:58 +02:00
dt-bindings	Fixes for omaps	2022-02-07 17:42:44 +01:00
keys
kunit	kunit: replace kernel.h with the necessary inclusions	2022-01-20 08:52:54 +02:00
kvm	RISCV:	2022-01-16 16:15:14 +02:00
linux	oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup	2022-04-27 14:41:11 +02:00
math-emu
media
memory
misc
net	ipv6: make ip6_rt_gc_expire an atomic_t	2022-04-27 14:41:01 +02:00
pcmcia
ras	mm/hwpoison: remove MF_MSG_BUDDY_2ND and MF_MSG_POISONED_HUGE	2022-01-15 16:30:31 +02:00
rdma
scsi	scsi: iscsi: Fix NOP handling during conn recovery	2022-04-27 14:41:10 +02:00
soc	soc: fsl: Replace kernel.h with the necessary inclusions	2022-02-18 17:11:17 -06:00
sound	ALSA: memalloc: Add fallback SG-buffer allocations for x86	2022-04-20 09:36:11 +02:00
target
trace	SUNRPC: Fix the svc_deferred_event trace class	2022-04-20 09:36:12 +02:00
uapi	io_uring: flag the fact that linked file assignment is sane	2022-04-20 09:36:14 +02:00
vdso
video
xen	xen/gnttab: fix gnttab_end_foreign_access() without page specified	2022-03-07 09:48:55 +01:00