Re: [PATCH] exit: fix oops in sync_mm_rss

[Minchan Kim]

On Wed, Mar 31, 2010 at 9:41 AM, KAMEZAWA Hiroyuki
<kamezawa.hiroyu@xxxxxxxxxxxxxx> wrote:
> On Tue, 30 Mar 2010 17:37:21 -0400
> Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> wrote:
>
>> On Wed, 31 Mar 2010 09:28:15 +0900 KAMEZAWA Hiroyuki <kamezawa.hiroyu@xxxxxxxxxxxxxx> wrote:
>>
>> > On Tue, 30 Mar 2010 13:56:34 -0700
>> > Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> wrote:
>> >
>> > > That new BUG_ON() is triggering in Troels's machine when a bluetooth
>> > > keyboard is enabled or disabled. ÂSee
>> > > (https://bugzilla.kernel.org/show_bug.cgi?id=15648.
>> > >
>> > > I guess the question is: how did a kernel thread get a non-zero
>> > > task->rss_stat.count[i]? ÂIf that's expected and OK then we will need
>> > > to take some kernel-thread-avoidance action there.
>> > >
>> > It seems my fault that it's not initialized to be 0 at do_fork(), copy_process.
>> >
>> > About do_exit, do_exit() does this check. So, tsk->mm can be NULL.
>> >
>> > Â949 Â Â Â Â if (group_dead) {
>> > Â950 Â Â Â Â Â Â Â Â hrtimer_cancel(&tsk->signal->real_timer);
>> > Â951 Â Â Â Â Â Â Â Â exit_itimers(tsk->signal);
>> > Â952 Â Â Â Â Â Â Â Â if (tsk->mm)
>> > Â953 Â Â Â Â Â Â Â Â Â Â Â Â setmax_mm_hiwater_rss(&tsk->signal->maxrss, tsk->mm);
>> > Â954 Â Â Â Â }
>> >
>> > > Could whoever fixes this please also make __sync_task_rss_stat()
>> > > static.
>> > >
>> > Ah, yes. I should do so.
>> >
>> > > I'll toss this over to Rafael/Maciej for tracking as a post-2.6.33
>> > > regression.
>> > >
>> > > Thanks.
>> > >
>> >
>> >
>> > ==
>> >
>> > task->rss_stat wasn't initialized to 0 at copy_process().
>> > at exit, tsk->mm may be NULL.
>> > And __sync_task_rss_stat() should be static.
>> >
>> > Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@xxxxxxxxxxxxxx>
>> > ---
>> > Âkernel/exit.c | Â Â3 ++-
>> > Âkernel/fork.c | Â Â3 +++
>> > Âmm/memory.c  |  Â2 +-
>> > Â3 files changed, 6 insertions(+), 2 deletions(-)
>> >
>> > Index: mmotm-2.6.34-Mar24/kernel/exit.c
>> > ===================================================================
>> > --- mmotm-2.6.34-Mar24.orig/kernel/exit.c
>> > +++ mmotm-2.6.34-Mar24/kernel/exit.c
>> > @@ -950,7 +950,8 @@ NORET_TYPE void do_exit(long code)
>> >
>> > Â Â acct_update_integrals(tsk);
>> > Â Â /* sync mm's RSS info before statistics gathering */
>> > - Â sync_mm_rss(tsk, tsk->mm);
>> > + Â if (tsk->mm)
>> > + Â Â Â Â Â sync_mm_rss(tsk, tsk->mm);
>> > Â Â group_dead = atomic_dec_and_test(&tsk->signal->live);
>> > Â Â if (group_dead) {
>> > Â Â Â Â Â Â hrtimer_cancel(&tsk->signal->real_timer);
>> > Index: mmotm-2.6.34-Mar24/mm/memory.c
>> > ===================================================================
>> > --- mmotm-2.6.34-Mar24.orig/mm/memory.c
>> > +++ mmotm-2.6.34-Mar24/mm/memory.c
>> > @@ -124,7 +124,7 @@ core_initcall(init_zero_pfn);
>> >
>> > Â#if defined(SPLIT_RSS_COUNTING)
>> >
>> > -void __sync_task_rss_stat(struct task_struct *task, struct mm_struct *mm)
>> > +static void __sync_task_rss_stat(struct task_struct *task, struct mm_struct *mm)
>> > Â{
>> > Â Â int i;
>> >
>> > Index: mmotm-2.6.34-Mar24/kernel/fork.c
>> > ===================================================================
>> > --- mmotm-2.6.34-Mar24.orig/kernel/fork.c
>> > +++ mmotm-2.6.34-Mar24/kernel/fork.c
>> > @@ -1060,6 +1060,9 @@ static struct task_struct *copy_process(
>> > Â Â p->prev_utime = cputime_zero;
>> > Â Â p->prev_stime = cputime_zero;
>> > Â#endif
>> > +#if defined(SPLIT_RSS_COUNTING)
>> > + Â memset(&p->rss_stat, 0, sizeof(p->rss_stat));
>> > +#endif
>> >
>> > Â Â p->default_timer_slack_ns = current->timer_slack_ns;
>>
>> OK, so the kenrel thread inherited a non-zero rss_stat from a userspace
>> parent?
>>
> I think so.
>
>> With this fixed, the test for non-zero tsk->mm is't really needed in
>> do_exit(), is it? ÂI guess it makes sense though - sync_mm_rss() only
>> really works for kernel threads by luck..
>
> At first, I considered so, too. But I changed my mind to show
> "we know tsk->mm can be NULL here!" by code.
> Because __sync_mm_rss_stat() has BUG_ON(!mm), the code reader will think
> tsk->mm shouldn't be NULL always.
>
> Doesn't make sense ?
>

Nitpick.
How about moving sync_mm_rss into after check !mm of exit_mm?



-- 
Kind regards,
Minchan Kim
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/