[Devel] [PATCH RHEL7 COMMIT] ms/mm: check for SIGKILL inside dup_mmap() loop

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-1160.80.1.vz7.191.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1160.80.1.vz7.191.2
------>
commit 2389d44ad3ab66777045aee2815b1510ed0997d3
Author: Alexander Atanasov <alexander.atanasov at virtuozzo.com>
Date:   Fri Dec 9 13:35:07 2022 +0200

    ms/mm: check for SIGKILL inside dup_mmap() loop
    
    As a theoretical problem, dup_mmap() of an mm_struct with 60000+ vmas
    can loop while potentially allocating memory, with mm->mmap_sem held for
    write by current thread.  This is bad if current thread was selected as
    an OOM victim, for current thread will continue allocations using memory
    reserves while OOM reaper is unable to reclaim memory.
    
    As an actually observable problem, it is not difficult to make OOM
    reaper unable to reclaim memory if the OOM victim is blocked at
    i_mmap_lock_write() in this loop.  Unfortunately, since nobody can
    explain whether it is safe to use killable wait there, let's check for
    SIGKILL before trying to allocate memory.  Even without an OOM event,
    there is no point with continuing the loop from the beginning if current
    thread is killed.
    
    I tested with debug printk().  This patch should be safe because we
    already fail if security_vm_enough_memory_mm() or
    kmem_cache_alloc(GFP_KERNEL) fails and exit_mmap() handles it.
    
       ***** Aborting dup_mmap() due to SIGKILL *****
       ***** Aborting dup_mmap() due to SIGKILL *****
       ***** Aborting dup_mmap() due to SIGKILL *****
       ***** Aborting dup_mmap() due to SIGKILL *****
       ***** Aborting exit_mmap() due to NULL mmap *****
    
     [akpm at linux-foundation.org: add comment]
     Link: http://lkml.kernel.org/r/201804071938.CDE04681.SOFVQJFtMHOOLF@I-love.SAKURA.ne.jp
     Signed-off-by: Tetsuo Handa <penguin-kernel at I-love.SAKURA.ne.jp>
     Cc: Alexander Viro <viro at zeniv.linux.org.uk>
     Cc: Rik van Riel <riel at redhat.com>
     Cc: Michal Hocko <mhocko at suse.com>
     Cc: Kirill A. Shutemov <kirill.shutemov at linux.intel.com>
     Cc: David Rientjes <rientjes at google.com>
     Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
     Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
    
    (cherry picked from ms commit 655c79bb40a0870adcd0871057d01de11625882b)
    Found in the scope of:
    https://jira.sw.ru/browse/PSBM-143415
    Signed-off-by: Alexander Atanasov <alexander.atanasov at virtuozzo.com>
---
 kernel/fork.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/kernel/fork.c b/kernel/fork.c
index 75ae37b0bf7b..9bb8efdad181 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -483,6 +483,14 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
 			continue;
 		}
 		charge = 0;
+		/*
+		 * Don't duplicate many vmas if we've been oom-killed (for
+		 * example)
+		 */
+		if (fatal_signal_pending(current)) {
+			retval = -EINTR;
+			goto out;
+		}
 		if (ub_memory_charge(mm, mpnt->vm_end - mpnt->vm_start,
 					mpnt->vm_flags & ~VM_LOCKED,
 					mpnt->vm_file, UB_HARD))