Messages in this thread | | | Date | Thu, 4 Feb 2010 14:53:32 -0800 (PST) | From | David Rientjes <> | Subject | Re: Improving OOM killer |
| |
On Thu, 4 Feb 2010, Frans Pop wrote:
> Shouldn't fork bomb detection take into account the age of children? > After all, long running processes with a lot of long running children are > rather unlikely to be runaway fork _bombs_. >
Yeah, Lubos mentioned using cpu time as a requirement, in addition to the already existing child->mm != parent->mm, as a prerequisite to be added into the tally to check the forkbomb threshold. I think something like this would be appropriate:
struct task_cputime task_time; int forkcount = 0; int child_rss = 0;
...
list_for_each_entry(child, &p->children, sibling) { unsigned long runtime;
task_lock(child); if (!child->mm || child->mm == p->mm) { task_unlock(child); continue; } thread_group_cputime(child, &task_time); runtime = cputime_to_jiffies(task_time.utime) + cputime_to_jiffies(task_time.stime);
/* * Only threads that have run for less than a second are * considered toward the forkbomb, these threads rarely * get to execute at all in such cases anyway. */ if (runtime < HZ) { task_unlock(child); continue; } child_rss += get_mm_rss(child->mm); forkcount++; }
if (forkcount > sysctl_oom_forkbomb_thres) { /* * Penalize forkbombs by considering the average rss and * how many factors we are over the threshold. */ points += child_rss / sysctl_oom_forkbomb_thres; }
I changed the calculation from lowest child rss to average child rss, so this is functionally equivalent to
(average rss size of children) * (# of first-generated execve children) / sysctl_oom_forkbomb_thres
| |