From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=91.218.175.242 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794437378; b=SRL8NA+ZoOZsWIkDHzTMSXdDZUrkd9uxNqTUOTyPsLLM8SQCAIRs5sQUa/Ot/8AxkyjO oWFAHv1Bn1I+uy892ydKx0NXsagN/uuli4Jr+gNlbzKlahIR3LpG4ou6H3aJVncGHph97 1DU6z4i9UnwSq0bH7D4zlstd0DXs9uiym0EW6X7Bg+y0dAmVVENIDQHtC1I0br/0j98rl WASIH518eD66WlDg3Di3gQs5h2qOSSu7yQZCemAOS/OEV620tNmjn8eUo36LFv9ZaNSDo cwY5MczbE88Olz8tbAPSpUBk1cD9KAuWeOonXKxt4/3tKP0t6Y0TaQa9pUu5akYdmuQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794437378; h=DMARC-Filter:X-Envelope-To:DKIM-Signature:X-Envelope-To:Received: X-Mizu-Trace-ID:X-Migadu-Flow:Message-ID:Date:MIME-Version:User-Agent: Subject:To:Cc:References:Content-Language:From:In-Reply-To: Content-Type:Content-Transfer-Encoding; bh=vQue7jLFUdSGesUi+3B7mc2JziPrIDnIULtffQJGgvg=; b=N5lyzxnqdJfMMXm8ZONRqLjHeZs1uPbMEr04yO7F4YZpCS+jFQpIqpFHwZRQOFuQNtg/ vleu1i46hWQtP9aN13ivK+ZC13SCb1JZw3zmNso8Y6VgppTApIJuzc9ooUkYgDHEunU5f CUemkpFJs/ctZe7aP0ZQYSJKoSm7sZOeLKtpiQGQ3SVcqOHJiAHJvL1L94+p4CDNTCP8f XanRlEZOdCYEUp0HlZtNBvqVMz+JJHYmo/oMKmiyl25xpVVR/Hgia7VfgjZNfcI/d1q/b LsGM3S49OqyC3b2w7b54e8g0gtj/t3OB1VwpYzLuInT5lUBo8TsDOYYz2Umee/0zNpQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass header.d=linux.dev header.i=@linux.dev header.a=rsa-sha256 header.s=key1 header.b=NGOjZg1k; arc=none smtp.remote-ip=91.218.175.242 Received: from mta0.migadu.com (out-242.mta0.migadu.com [91.218.175.242]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 40435606A335 for ; Wed, 11 Nov 2026 22:49:36 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 40435606A335 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linux.dev header.i=@linux.dev header.a=rsa-sha256 header.s=key1 header.b=NGOjZg1k X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=TJQVUzglty5DBhKdqOJX7Uq+2tUl+AilQ8bRBeO+zoU=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1794437375; v=1; x=1795042175; b=NGOjZg1kEgy3pz8LKNVfq9xcU6WU08nFKlG0U3hFRV46SsAguTFXlvwzbAckX2UtQ8gBRTcm NMTDlX+JyjqrDjKcEJHtHyM1cfA9R1d8DeBSRuQjVllwxhNvPrnGRHsVvVN6RZZ+md/YzcF2nYp uImjB4h8am86aMNefRqQVhlo= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id 7aea4d3fde09893e; Wed, 11 Nov 2026 22:49:34 +0000 X-Mizu-Trace-ID: 7aea4d3fde09893e X-Migadu-Flow: FLOW_OUT Message-ID: Date: Wed, 11 Nov 2026 22:49:34 +0000 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 01/13] mm/mmap: free gathered pages before MMF_OOM_SKIP To: "Lorenzo Stoakes (ARM)" , David Hildenbrand , "Liam R. Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , David Rientjes , Shakeel Butt , Andrew Morton , Jann Horn , Pedro Falcato , "Matthew Wilcox (Oracle)" , Jan Kara , Nhat Pham , Johannes Weiner , Zi Yan , Matthew Brost , Joshua Hahn , Byungchul Park , Gregory Price , Ying Huang , Alistair Popple , Kairui Song , Balbir Singh , =?UTF-8?B?SsOpcsO0bWUgR2xpc3Nl?= , Kiryl Shutsemau , Yu-cheng Yu , Dave Hansen , Dennis Zhou , Tejun Heo , Christoph Lameter , Peng Fan , Josef Bacik , Chris Mason Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, "Borislav Petkov (AMD)" , Mark Brown , "Dennis Zhou (Facebook)" , Rick Edgecombe , stable@vger.kernel.org References: <20261111-mason-migrate-et-al-fixes-v1-0-3d2454362e8d@kernel.org> <20261111-mason-migrate-et-al-fixes-v1-1-3d2454362e8d@kernel.org> Content-Language: en-US From: Usama Arif In-Reply-To: <20261111-mason-migrate-et-al-fixes-v1-1-3d2454362e8d@kernel.org> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On 11/11/2026 18:13, Lorenzo Stoakes (ARM) wrote: > The OOM killer can quickly trigger again after having selected a > victim. That victim might not have freed its memory yet, but its mm will > be marked MMF_OOM_SKIP by this point, so the OOM killer will ignore it. > > This can cause the OOM killer to kill an innocent process when the first > might have freed enough memory to relieve the memory pressure. > > Fix the issue by freeing the memory before marking the mm MMF_OOM_SKIP. > > Note that the task which calls mmput() might not be the victim - if it > took a reference on the mm (e.g. ptrace), it may hold the last reference > and release it when it calls mmput(). > > Therefore we cannot rely on current to tell whether the mm belongs to an > OOM victim. Instead, partially revert commit b3541d912a84 ("mm: delete > unused MMF_OOM_VICTIM flag") to reinstate MMF_OOM_VICTIM, which > mark_oom_victim() sets on the victim's mm, and check that. > > Reported-by: Chris Mason > Fixes: bf3980c85212 ("mm: drop oom code from exit_mmap") > Cc: > Signed-off-by: Lorenzo Stoakes (ARM) > --- Makes sense, it will free an OOM victim’s pages before setting MMF_OOM_SKIP, avoiding unnecessary additional kills. Acked-by: Usama Arif > include/linux/mm_types.h | 2 ++ > include/linux/oom.h | 9 +++++++++ > mm/mmap.c | 9 ++++++++- > mm/oom_kill.c | 4 +++- > 4 files changed, 22 insertions(+), 2 deletions(-) > > diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h > index 1ed35d258d2e..09e63ff12b04 100644 > --- a/include/linux/mm_types.h > +++ b/include/linux/mm_types.h > @@ -2030,6 +2030,8 @@ enum { > #define MMF_TOPDOWN 31 /* mm searches top down by default */ > #define MMF_TOPDOWN_MASK BIT(MMF_TOPDOWN) > > +#define MMF_OOM_VICTIM 32 /* mm is the oom victim */ > + > #define MMF_INIT_LEGACY_MASK (MMF_DUMP_FILTER_MASK |\ > MMF_DISABLE_THP_MASK | MMF_HAS_MDWE_MASK |\ > MMF_VM_MERGE_ANY_MASK | MMF_TOPDOWN_MASK) > diff --git a/include/linux/oom.h b/include/linux/oom.h > index 00da05d227e6..a9390cb70541 100644 > --- a/include/linux/oom.h > +++ b/include/linux/oom.h > @@ -76,6 +76,15 @@ static inline bool tsk_is_oom_victim(struct task_struct * tsk) > return tsk->signal->oom_mm; > } > > +/* > + * Use this helper if tsk->mm != mm and the victim mm needs a special > + * handling. This is guaranteed to stay true after once set. > + */ > +static inline bool mm_is_oom_victim(struct mm_struct *mm) > +{ > + return mm_flags_test(MMF_OOM_VICTIM, mm); > +} > + > /* > * Checks whether a page fault on the given mm is still reliable. > * This is no longer true if the oom reaper started to reap the > diff --git a/mm/mmap.c b/mm/mmap.c > index 7618e72766a5..4cb18b217048 100644 > --- a/mm/mmap.c > +++ b/mm/mmap.c > @@ -1313,11 +1313,18 @@ void exit_mmap(struct mm_struct *mm) > /* update_hiwater_rss(mm) here? but nobody should be looking */ > /* Use ULONG_MAX here to ensure all VMAs in the mm are unmapped */ > unmap_vmas(&tlb, &unmap); > + > + /* > + * Free the memory before marking MMF_OOM_SKIP so a re-triggered OOM > + * killer will only skip this mm if it's already freed all it can. > + */ > + if (mm_is_oom_victim(mm)) > + tlb_flush_mmu(&tlb); > mmap_read_unlock(mm); > > /* > * Set MMF_OOM_SKIP to hide this task from the oom killer/reaper > - * because the memory has been already freed. > + * because the memory has been already unmapped. > */ > mm_flags_set(MMF_OOM_SKIP, mm); > mmap_write_lock(mm); > diff --git a/mm/oom_kill.c b/mm/oom_kill.c > index 5d48bd862c27..9de57a23893c 100644 > --- a/mm/oom_kill.c > +++ b/mm/oom_kill.c > @@ -752,8 +752,10 @@ static void mark_oom_victim(struct task_struct *tsk) > return; > > /* oom_mm is bound to the signal struct life time. */ > - if (!cmpxchg(&tsk->signal->oom_mm, NULL, mm)) > + if (!cmpxchg(&tsk->signal->oom_mm, NULL, mm)) { > mmgrab(tsk->signal->oom_mm); > + mm_flags_set(MMF_OOM_VICTIM, mm); > + } > > /* > * Make sure that the process is woken up from uninterruptible sleep >