Re: Improving OOM killer

David Rientjes
2010-02-04T22:53:42Z

On Thu, 4 Feb 2010, Frans Pop wrote:

> Shouldn't fork bomb detection take into account the age of children?
> After all, long running processes with a lot of long running children are
> rather unlikely to be runaway fork _bombs_.
>

Yeah, Lubos mentioned using cpu time as a requirement, in addition to the
already existing child->mm != parent->mm, as a prerequisite to be added
into the tally to check the forkbomb threshold. I think something like
this would be appropriate:

struct task_cputime task_time;
int forkcount = 0;
int child_rss = 0;

...

list_for_each_entry(child, &p->children, sibling) {
unsigned long runtime;

task_lock(child);
if (!child->mm || child->mm == p->mm) {
task_unlock(child);
continue;
}
thread_group_cputime(child, &task_time);
runtime = cputime_to_jiffies(task_time.utime) +
cputime_to_jiffies(task_time.stime);

/*
* Only threads that have run for less than a second are
* considered toward the forkbomb, these threads rarely
* get to execute at all in such cases anyway.
*/
if (runtime < HZ) {
task_unlock(child);
continue;
}
child_rss += get_mm_rss(child->mm);
forkcount++;
}

if (forkcount > sysctl_oom_forkbomb_thres) {
/*
* Penalize forkbombs by considering the average rss and
* how many factors we are over the threshold.
*/
points += child_rss / sysctl_oom_forkbomb_thres;
}

I changed the calculation from lowest child rss to average child rss, so
this is functionally equivalent to

(average rss size of children) * (# of first-generated execve children) /
sysctl_oom_forkbomb_thres