[Devel] [PATCH rh7 2/2] exit: clear TIF_MEMDIE after exit_task_work

[Kirill Tkhai]

On 01.03.2016 12:16, Kirill Tkhai wrote:
> On 29.02.2016 18:58, Vladimir Davydov wrote:
>> An mm_struct may be pinned by a file. An example is vhost-net device
>> created by a qemu/kvm (see vhost_net_ioctl -> vhost_net_set_owner ->
>> vhost_dev_set_owner). If such process gets OOM-killed, the reference to
>> its mm_struct will only be released from exit_task_work -> ____fput ->
>> __fput -> vhost_net_release -> vhost_dev_cleanup, which is called after
>> exit_mmap, where TIF_MEMDIE is cleared. As a result, we can start
>> selecting the next victim before giving the last one a chance to free
>> its memory. In practice, this leads to killing several VMs along with
>> the fattest one.
> 
> Do we have the same issue when group_leader's threads are owning the mm?

I.e. !group_leader, but threads in its group.

>> https://jira.sw.ru/browse/PSBM-44683
>>
>> Signed-off-by: Vladimir Davydov <vdavydov at virtuozzo.com>
>> ---
>>  kernel/exit.c | 6 ++++--
>>  1 file changed, 4 insertions(+), 2 deletions(-)
>>
>> diff --git a/kernel/exit.c b/kernel/exit.c
>> index 1cc765b48bd7..2715dc1dc0f5 100644
>> --- a/kernel/exit.c
>> +++ b/kernel/exit.c
>> @@ -520,8 +520,6 @@ static void exit_mm(struct task_struct * tsk)
>>  	task_unlock(tsk);
>>  	mm_update_next_owner(mm);
>>  	mmput(mm);
>> -	if (test_thread_flag(TIF_MEMDIE))
>> -		exit_oom_victim();
>>  }
>>  
>>  /*
>> @@ -819,6 +817,10 @@ void do_exit(long code)
>>  	exit_fs(tsk);
>>  	exit_task_namespaces(tsk);
>>  	exit_task_work(tsk);
>> +
>> +	if (test_thread_flag(TIF_MEMDIE))
>> +		exit_oom_victim();
>> +
>>  	check_stack_usage();
>>  	exit_thread();
>>  
>>