The quilt patch titled
Subject: mm,oom_reaper: avoid run queue_oom_reaper if task is not oom
has been removed from the -mm tree. Its filename was
mmoom_reaper-avoid-run-queue_oom_reaper-if-task-is-not-oom.patch
This patch was dropped because it was nacked
------------------------------------------------------
From: gaoxu <gaoxu2(a)hihonor.com>
Subject: mm,oom_reaper: avoid run queue_oom_reaper if task is not oom
Date: Wed, 22 Nov 2023 12:46:44 +0000
queue_oom_reaper() tests and sets tsk->signal->oom_mm->flags. However, it
is necessary to check if 'tsk' is an OOM victim before executing
'queue_oom_reaper' because the variable may be NULL.
We encountered such an issue, and the log is as follows:
[3701:11_see]Out of memory: Killed process 3154 (system_server)
total-vm:23662044kB, anon-rss:0kB, file-rss:0kB, shmem-rss:0kB,
UID:1000 pgtables:4056kB oom_score_adj:-900
[3701:11_see][RB/E]rb_sreason_str_set: sreason_str set null_pointer
[3701:11_see][RB/E]rb_sreason_str_set: sreason_str set unknown_addr
[3701:11_see]Unable to handle kernel NULL pointer dereference at virtual
address 0000000000000328
[3701:11_see]user pgtable: 4k pages, 39-bit VAs, pgdp=3D00000000821de000
[3701:11_see][0000000000000328] pgd=3D0000000000000000,
p4d=3D0000000000000000,pud=3D0000000000000000
[3701:11_see]tracing off
[3701:11_see]Internal error: Oops: 96000005 [#1] PREEMPT SMP
[3701:11_see]Call trace:
[3701:11_see] queue_oom_reaper+0x30/0x170
[3701:11_see] __oom_kill_process+0x590/0x860
[3701:11_see] oom_kill_process+0x140/0x274
[3701:11_see] out_of_memory+0x2f4/0x54c
[3701:11_see] __alloc_pages_slowpath+0x5d8/0xaac
[3701:11_see] __alloc_pages+0x774/0x800
[3701:11_see] wp_page_copy+0xc4/0x116c
[3701:11_see] do_wp_page+0x4bc/0x6fc
[3701:11_see] handle_pte_fault+0x98/0x2a8
[3701:11_see] __handle_mm_fault+0x368/0x700
[3701:11_see] do_handle_mm_fault+0x160/0x2cc
[3701:11_see] do_page_fault+0x3e0/0x818
[3701:11_see] do_mem_abort+0x68/0x17c
[3701:11_see] el0_da+0x3c/0xa0
[3701:11_see] el0t_64_sync_handler+0xc4/0xec
[3701:11_see] el0t_64_sync+0x1b4/0x1b8
[3701:11_see]tracing off
Link: https://lkml.kernel.org/r/400d13bddb524ef6af37cb2220808c75@hihonor.com
Signed-off-by: Gao Xu <gaoxu2(a)hihonor.com>
Cc: Suren Baghdasaryan <surenb(a)google.com>
Cc: Michal Hocko <mhocko(a)suse.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/oom_kill.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/oom_kill.c~mmoom_reaper-avoid-run-queue_oom_reaper-if-task-is-not-oom
+++ a/mm/oom_kill.c
@@ -984,7 +984,7 @@ static void __oom_kill_process(struct ta
}
rcu_read_unlock();
- if (can_oom_reap)
+ if (can_oom_reap && tsk_is_oom_victim(victim))
queue_oom_reaper(victim);
mmdrop(mm);
_
Patches currently in -mm which might be from gaoxu2(a)hihonor.com are
Hi Greg
6.6.3-rc1
compiles, boots and runs[1] here on x86_64
(Intel Rocket Lake: i5-11400)
Thanks
[1] a vbox crash I first got known off today:
https://www.virtualbox.org/ticket/21898
Tested-by: Ronald Warsow <rwarsow(a)gmx.de>
Hi Greg, Sasha,
The batch contains Netfilter fixes for -stable 5.4. This batch is
targeting at garbage collection (GC) / set timeout fixes that address
possible UaF and memleaks as well as assorted bugs.
I am using original commit IDs for reference:
1) 0c2a85edd143 ("netfilter: nf_tables: pass context to nft_set_destroy()")
2) f8bb7889af58 ("netfilter: nftables: rename set element data activation/deactivation functions")
3) 628bd3e49cba ("netfilter: nf_tables: drop map element references from preparation phase")
4) c9e6978e2725 ("netfilter: nft_set_rbtree: Switch to node list walk for overlap detection")
5) 61ae320a29b0 ("netfilter: nft_set_rbtree: fix null deref on element insertion")
6) f718863aca46 ("netfilter: nft_set_rbtree: fix overlap expiration walk")
7) 24138933b97b ("netfilter: nf_tables: don't skip expired elements during walk")
8) 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane")
9) f6c383b8c31a ("netfilter: nf_tables: adapt set backend to use GC transaction API")
10) c92db3030492 ("netfilter: nft_set_hash: mark set element as dead when deleting from packet path")
11) a2dd0233cbc4 ("netfilter: nf_tables: remove busy mark and gc batch API")
12) 6a33d8b73dfa ("netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path")
13) 02c6c24402bf ("netfilter: nf_tables: GC transaction race with netns dismantle")
14) 720344340fb9 ("netfilter: nf_tables: GC transaction race with abort path")
15) 8357bc946a2a ("netfilter: nf_tables: use correct lock to protect gc_list")
16) 8e51830e29e1 ("netfilter: nf_tables: defer gc run if previous batch is still pending")
17) 2ee52ae94baa ("netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction")
18) 96b33300fba8 ("netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention")
19) b079155faae9 ("netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration")
20) cf5000a7787c ("netfilter: nf_tables: fix memleak when more than 255 elements expired")
21) 6069da443bf6 ("netfilter: nf_tables: unregister flowtable hooks on netns exit")
22) f9a43007d3f7 ("netfilter: nf_tables: double hook unregistration in netns path")
23) 0ce7cf4127f1 ("netfilter: nftables: update table flags from the commit phase")
24) 179d9ba5559a ("netfilter: nf_tables: fix table flag updates")
25) c9bd26513b3a ("netfilter: nf_tables: disable toggling dormant table state more than once")
26) ("netfilter: nf_tables: bogus EBUSY when deleting flowtable after flush (for 5.4)")
does not exist in any tree, but it is required to fix a bogus EBUSY error in 5.4.
This bug was implicitly fixed by 3f0465a9ef02 ("netfilter: nf_tables: dynamically
allocate hooks per net_device in flowtables").
Please apply,
Thanks.
Florian Westphal (4):
netfilter: nft_set_rbtree: fix null deref on element insertion
netfilter: nft_set_rbtree: fix overlap expiration walk
netfilter: nf_tables: don't skip expired elements during walk
netfilter: nf_tables: defer gc run if previous batch is still pending
Pablo Neira Ayuso (22):
netfilter: nf_tables: pass context to nft_set_destroy()
netfilter: nftables: rename set element data activation/deactivation functions
netfilter: nf_tables: drop map element references from preparation phase
netfilter: nft_set_rbtree: Switch to node list walk for overlap detection
netfilter: nf_tables: GC transaction API to avoid race with control plane
netfilter: nf_tables: adapt set backend to use GC transaction API
netfilter: nft_set_hash: mark set element as dead when deleting from packet path
netfilter: nf_tables: remove busy mark and gc batch API
netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path
netfilter: nf_tables: GC transaction race with netns dismantle
netfilter: nf_tables: GC transaction race with abort path
netfilter: nf_tables: use correct lock to protect gc_list
netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention
netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration
netfilter: nf_tables: fix memleak when more than 255 elements expired
netfilter: nf_tables: unregister flowtable hooks on netns exit
netfilter: nf_tables: double hook unregistration in netns path
netfilter: nftables: update table flags from the commit phase
netfilter: nf_tables: fix table flag updates
netfilter: nf_tables: disable toggling dormant table state more than once
netfilter: nf_tables: bogus EBUSY when deleting flowtable after flush (for 5.4)
include/net/netfilter/nf_tables.h | 129 +++---
include/uapi/linux/netfilter/nf_tables.h | 1 +
net/netfilter/nf_tables_api.c | 512 +++++++++++++++++++----
net/netfilter/nft_chain_filter.c | 3 +
net/netfilter/nft_set_bitmap.c | 5 +-
net/netfilter/nft_set_hash.c | 110 +++--
net/netfilter/nft_set_rbtree.c | 375 +++++++++++++----
7 files changed, 867 insertions(+), 268 deletions(-)
--
2.30.2