From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dl1-f42.google.com (mail-dl1-f42.google.com [74.125.82.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 501B23ACA4B for ; Wed, 29 Apr 2026 21:14:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.42 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777497265; cv=none; b=pr60JXUtKl+/b4NHTGGALSRdPzK/hU4A0uXeTeZcMr/yvns6UruNlWYx8m6Ghg6nZmLKdZKWLwRqdU4HHY87fCQtMawQjuraSS/u9cEetaPCDFr4I2x08ZXnuBTLorzlZajYm0B7IKeXupPCIpI1crYb4FiqVW+cG6c+y5Xl1yY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777497265; c=relaxed/simple; bh=iMdpSNk8+RaGvFrZtAgkNCTaLGJq9rYLnclyIXgOR1w=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=TmXR/qgOLcQ8uZ9FZlaEcyuqyvgab1O/zZs8y2PEXo760b1sE9WXJbhBYDXj+uj/1XIVIfFpGpd4YS+M8KXY1wVxvP+A+W+Lk2NFqUxgJKU75MOYLdIDT4mmiQge9PIutlVtpaOJwHAMXjbyyl33Gd7Wnx9u1739EzApAxWvq14= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=quarantine dis=none) header.from=kernel.org; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=MXd4GLjS; arc=none smtp.client-ip=74.125.82.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=quarantine dis=none) header.from=kernel.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="MXd4GLjS" Received: by mail-dl1-f42.google.com with SMTP id a92af1059eb24-12ddbe104ccso227299c88.0 for ; Wed, 29 Apr 2026 14:14:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1777497263; x=1778102063; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:sender:from:to:cc:subject:date:message-id:reply-to; bh=0jlWaNcc6qDFBI62ibD+GVbVAHZzVlW6Nqyi6nQpvzc=; b=MXd4GLjS2k2eUQwS5dCqESwgPK51tc6mh1JpzR0iTyt4uUlLSk6cduY1DmyI0SoSRg HJ5ka8Om4oq0S52pUrSy2S2xBXeUek3RnSpHW1S+4vno5jRIyT7Snw8ZVKwcSm9TVWCi O8XzcUojEY3C7WW1i+C7bgPM1in2nyaMGWXM+UhaFx5/VGPGd7umzd1K7tMyMWniN36x IVrWRCsryKsBoVmq82V4SJGShfX9PZBU6NR8MaUaW9KHBWDoAYlzQpLonEfvnd4i7jqm fNsME3udEdADp6nRYVUVm+fh/puO2cTohgIL28wDWTZl+R7DCq65j/FmGpU6yYu5s6ZN aXGg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777497263; x=1778102063; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:sender:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=0jlWaNcc6qDFBI62ibD+GVbVAHZzVlW6Nqyi6nQpvzc=; b=d1Xic+nGvuImjh1llzPrjiyQTQAKieblDRTuT+uDN1LMmDf9nSPg++NOwrEagDE/pi Tqhv2MoCxYEK08Y+4TgSbbj2lxNA5ckAxevlp77hi9amnh72NWF9GZ2RtStKpBI6oRbH RDNEV7ywJtMVtFTOYuElMQZIe7UDDmNvUzMRQSnnIZDs728hKwfYLiUeHByz6PDwerY+ W3uZU6G3+ELC8J+gNWDgQbVRmSM79fOmJV+GEQzfTy8O+Oc6ah3nUVNdZF65B/RjcuHH PoHh+vMtWHFzdfQcVCNBSN614R4FZ9xWiUzleYdKbI9obtZO+HkwpHlwT6rLgBoP0B6S INdg== X-Forwarded-Encrypted: i=1; AFNElJ8zTTbOLqckahH0svi5VhkULpsvu+pj+u3tTPGXrfFRqxEHgPsZUqAHU4BHc0CHPgQ951qccpgyga87PJE=@vger.kernel.org X-Gm-Message-State: AOJu0YwFkQB8is4bMzqEHJguxOMQ6LfwkfJv4RlL9REHAmnc4HuTLa0f bQhoXRn/f5ZEh9uzcpAP3pu0T+QqxIB4BldoweQO11DX5AahNyp33Ulw X-Gm-Gg: AeBDievHiyIifOym6CVgVttSuzLfuR/Tr01/m8JtNsojGZuf0BjAzPPj9Qtf1uW5jVP pOaY0dznHZd1fns+wwp9MLYx6nUXh1qfM4WDaqDKw5NvT+fVzVyQXXMzZY9IRXF9hNm+FSp2LVw BiiCWjfjInu8zDMy3u9zs9D9Te6dyXcP+311qxP2zbnG7Rqy6B8Kk2J+ZnAN8dmJWutcSe9hEV+ +Z5+YofLZHuW0P024KqU3b5q4HAr10n/jdlPB5bG8trKunpXTob2glPosmbDlI9Jyxz6q8MfnfU Xz730UYLJdFebV6d8MOYtj/ag51dvjCdUeeIUfnVIl8DRI+6VyfF2eMwT5H6XIUq0Tyzmt50/su npbjH6GgS4FeusXyEG5RnqwNDxw17D7VP7v+f1TSwoYsuTWngK9kisx2TnJXvMRjQ5x15sWckEl RQSF6EmgTNJ4RiaV6u3s3GpAEATamVbfQPMmX/L9dNGKTgGG5taCd/lQeNQ652ePhb9KJBy6uYQ kVGyhItdYOoHKo= X-Received: by 2002:a05:7022:3d12:b0:128:d715:b717 with SMTP id a92af1059eb24-12deac586damr120667c88.13.1777497263244; Wed, 29 Apr 2026 14:14:23 -0700 (PDT) Received: from bbox-1.mtv.corp.google.com ([2a00:79e0:2e7c:8:ef7d:2499:eb8e:9f62]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-12de320ed98sm4408879c88.3.2026.04.29.14.14.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 29 Apr 2026 14:14:22 -0700 (PDT) Sender: Minchan Kim From: Minchan Kim To: akpm@linux-foundation.org Cc: hca@linux.ibm.com, linux-s390@vger.kernel.org, david@kernel.org, mhocko@suse.com, brauner@kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, surenb@google.com, timmurray@google.com, Minchan Kim Subject: [PATCH v2] mm: process_mrelease: introduce PROCESS_MRELEASE_REAP_KILL flag Date: Wed, 29 Apr 2026 14:13:59 -0700 Message-ID: <20260429211359.3829683-1-minchan@kernel.org> X-Mailer: git-send-email 2.54.0.545.g6539524ca2-goog Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Currently, process_mrelease() requires userspace to send a SIGKILL signal prior to invocation. This separation introduces a scheduling race window where the victim task may receive the signal and enter the exit path before the reaper can invoke process_mrelease(). When the victim enters the exit path (do_exit -> exit_mm), it clears its task->mm immediately. This causes process_mrelease() to fail with -ESRCH, leaving the actual address space teardown (exit_mmap) to be deferred until the mm's reference count drops to zero. In the field (e.g., Android), arbitrary reference counts (reading /proc//cmdline, or various other remote VM accesses) frequently delay this teardown indefinitely, defeating the purpose of expedited reclamation. In Android's LMKD scenarios, this delay keeps memory pressure high, forcing the system to unnecessarily kill additional innocent background apps before the memory from the first victim is recovered. This patch introduces the PROCESS_MRELEASE_REAP_KILL UAPI flag to support an integrated auto-kill mode. When specified, process_mrelease() directly injects a SIGKILL into the target task after finding its mm. To solve the race condition, we grab the mm reference via mmgrab() before sending the SIGKILL. If the user passed PROCESS_MRELEASE_REAP_KILL, we assume it will free its memory and proceed with reaping, making the logic as simple as reap = reap_kill || task_will_free_mem(p). To handle shared address spaces safely in the auto-kill mode, we bail out immediately if the mm is marked with MMF_MULTIPROCESS when PROCESS_MRELEASE_REAP_KILL is specified. This protects existing users of process_mrelease() from behavior changes while preventing unsafe reaping of shared memory. This policy differs from the global OOM killer, which kills all processes sharing the same mm to guarantee memory reclamation at all costs (preventing system hangs). However, process_mrelease() is invoked by userspace policy. If it fails due to sharing, userspace can simply adapt and select another victim process (such as another background app in Android case) to release memory. We do not need to force success or affect processes that were not targeted. Fundamentally, this allows process_mrelease() to trigger targeted memory reclaim (via oom_reaper infrastructure) quickly, even if the victim is not yet in the exit path, while reusing existing race handling between reaper and exit_mmap. Suggested-by: Michal Hocko Reviewed-by: Suren Baghdasaryan Signed-off-by: Minchan Kim --- include/uapi/linux/mman.h | 4 ++++ mm/oom_kill.c | 27 ++++++++++++++++++++------- 2 files changed, 24 insertions(+), 7 deletions(-) diff --git a/include/uapi/linux/mman.h b/include/uapi/linux/mman.h index e89d00528f2f..4266976b45ad 100644 --- a/include/uapi/linux/mman.h +++ b/include/uapi/linux/mman.h @@ -56,4 +56,8 @@ struct cachestat { __u64 nr_recently_evicted; }; +/* Flags for process_mrelease */ +#define PROCESS_MRELEASE_REAP_KILL (1 << 0) +#define PROCESS_MRELEASE_VALID_FLAGS (PROCESS_MRELEASE_REAP_KILL) + #endif /* _UAPI_LINUX_MMAN_H */ diff --git a/mm/oom_kill.c b/mm/oom_kill.c index 5c6c95c169ee..efa6541b1c47 100644 --- a/mm/oom_kill.c +++ b/mm/oom_kill.c @@ -20,6 +20,7 @@ #include #include +#include #include #include #include @@ -1217,9 +1218,11 @@ SYSCALL_DEFINE2(process_mrelease, int, pidfd, unsigned int, flags) unsigned int f_flags; bool reap = false; long ret = 0; + bool reap_kill; - if (flags) + if (flags & ~PROCESS_MRELEASE_VALID_FLAGS) return -EINVAL; + reap_kill = !!(flags & PROCESS_MRELEASE_REAP_KILL); task = pidfd_get_task(pidfd, &f_flags); if (IS_ERR(task)) @@ -1236,19 +1239,29 @@ SYSCALL_DEFINE2(process_mrelease, int, pidfd, unsigned int, flags) } mm = p->mm; - mmgrab(mm); + if (reap_kill && mm_flags_test(MMF_MULTIPROCESS, mm)) { + ret = -EINVAL; + task_unlock(p); + goto put_task; + } - if (task_will_free_mem(p)) - reap = true; - else { + reap = reap_kill || task_will_free_mem(p); + if (!reap) { /* Error only if the work has not been done already */ if (!mm_flags_test(MMF_OOM_SKIP, mm)) ret = -EINVAL; + task_unlock(p); + goto put_task; } + + mmgrab(mm); task_unlock(p); - if (!reap) - goto drop_mm; + if (reap_kill) { + ret = kill_pid(task_tgid(task), SIGKILL, 0); + if (ret) + goto drop_mm; + } if (mmap_read_lock_killable(mm)) { ret = -EINTR; -- 2.54.0.545.g6539524ca2-goog