Oleg Nesterov wrote: > Both "child->mm == mm" and "p->mm != mm" checks in oom_kill_process() > are wrong. ->mm can be if task is the exited group leader. This means
can be [missing word here?] if task > +static bool process_has_mm(struct task_struct *p, struct mm_struct *mm) > +{ > + struct task_struct *t; > + > + for_each_thread(p, t) > + if (t->mm) Can t->mm change between pevious line and next line? > + return t->mm == mm; > + > + return false; > +} > + > #define K(x) ((x) << (PAGE_SHIFT-10)) > /* > * Must be called while holding a reference to p, which will be released upon > @@ -530,7 +541,7 @@ void oom_kill_process(struct oom_control *oc, struct > task_struct *p, > list_for_each_entry(child, &t->children, sibling) { > unsigned int child_points; > > - if (child->mm == p->mm) > + if (process_has_mm(child, p->mm)) > continue; We hold read_lock(&tasklist_lock) but not rcu_read_lock(). Is for_each_thread() safe without rcu_read_lock()? > /* > * oom_badness() returns 0 if the thread is unkillable -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/