From patchwork Sun Nov 21 22:02:10 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: zeng.zhaoming@freescale.com X-Patchwork-Id: 72503 Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 26AEAB70E2 for ; Mon, 22 Nov 2010 17:01:29 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751281Ab0KVGB1 (ORCPT ); Mon, 22 Nov 2010 01:01:27 -0500 Received: from tx2ehsobe002.messaging.microsoft.com ([65.55.88.12]:23388 "EHLO TX2EHSOBE004.bigfish.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750967Ab0KVGB1 (ORCPT ); Mon, 22 Nov 2010 01:01:27 -0500 Received: from mail197-tx2-R.bigfish.com (10.9.14.242) by TX2EHSOBE004.bigfish.com (10.9.40.24) with Microsoft SMTP Server id 14.1.225.8; Mon, 22 Nov 2010 06:01:26 +0000 Received: from mail197-tx2 (localhost.localdomain [127.0.0.1]) by mail197-tx2-R.bigfish.com (Postfix) with ESMTP id 54B008001F0; Mon, 22 Nov 2010 06:01:26 +0000 (UTC) X-SpamScore: 20 X-BigFish: VS20(zzzz1202hzz8275eh8275bh3198r3284qa1495iz2dh2a8h668h67dh685h67h) X-Spam-TCS-SCL: 6:0 X-Forefront-Antispam-Report: KIP:(null); UIP:(null); IPVD:NLI; H:az33egw01.freescale.net; RD:az33egw01.freescale.net; EFVD:NLI Received: from mail197-tx2 (localhost.localdomain [127.0.0.1]) by mail197-tx2 (MessageSwitch) id 129040568643443_31979; Mon, 22 Nov 2010 06:01:26 +0000 (UTC) Received: from TX2EHSMHS005.bigfish.com (unknown [10.9.14.240]) by mail197-tx2.bigfish.com (Postfix) with ESMTP id 06B361E8051; Mon, 22 Nov 2010 06:01:26 +0000 (UTC) Received: from az33egw01.freescale.net (192.88.158.102) by TX2EHSMHS005.bigfish.com (10.9.99.105) with Microsoft SMTP Server (TLS) id 14.1.225.8; Mon, 22 Nov 2010 06:01:25 +0000 Received: from az33smr02.freescale.net (az33smr02.freescale.net [10.64.34.200]) by az33egw01.freescale.net (8.14.3/8.14.3) with ESMTP id oAM61D31000540; Sun, 21 Nov 2010 23:01:13 -0700 (MST) Received: from localhost.localdomain ([10.192.225.33]) by az33smr02.freescale.net (8.13.1/8.13.0) with ESMTP id oAM61Af6002469; Mon, 22 Nov 2010 00:01:10 -0600 (CST) From: To: CC: , , , , , Zeng Zhaoming Subject: [PATCH] ext4: Fix memory leak in groupinfo cache name Date: Mon, 22 Nov 2010 06:02:10 +0800 Message-ID: <1290376931-2129-1-git-send-email-zeng.zhaoming@freescale.com> X-Mailer: git-send-email 1.7.0.4 MIME-Version: 1.0 X-OriginatorOrg: freescale.com Sender: linux-ext4-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org From: Zeng Zhaoming please check the discuss with allocator guys. http://marc.info/?l=linux-kernel&m=129004890020256&w=2 Get a memory leak about ext4: comm "mount", pid 1159, jiffies 4294904647 (age 6077.804s) hex dump (first 32 bytes): 65 78 74 34 5f 67 72 6f 75 70 69 6e 66 6f 5f 31 ext4_groupinfo_1 30 00 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 0.kkkkkkkkkkkkk. backtrace: [] kmemleak_alloc+0x93/0xd0 [] __kmalloc_track_caller+0x30c/0x380 [] kstrdup+0x33/0x60 [] ext4_mb_init+0x4e0/0x550 [] ext4_fill_super+0x1e6e/0x2f60 [] mount_bdev+0x1c0/0x1f0 [] ext4_mount+0x1f/0x30 [] vfs_kern_mount+0x78/0x250 [] do_kern_mount+0x3e/0x100 [] do_mount+0x2e2/0x780 [] sys_mount+0xa4/0xd0 [] sysenter_do_call+0x12/0x38 [] 0xffffffff ext4 allocate memory for cache name by: namep = kstrdup(name, GFP_KERNEL); and reclaim it by: name = kmem_cache_name(cache); kfree(name) This is ok if allocator only reference to the cache name memory, and return the name memory pass to kmem_cache_create() by kmem_cache_name(); But not true in slub, when using slub, memory leak and double free error appears. In this patch, we track the cache name memory in ext4, rather than allocator. Signed-off-by: Zeng Zhaoming --- fs/ext4/mballoc.c | 24 ++++++++++++++++-------- 1 files changed, 16 insertions(+), 8 deletions(-) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 5b4d4e3..c744661 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -344,7 +344,13 @@ static struct kmem_cache *ext4_free_ext_cachep; * each unique s_blocksize_bits */ #define NR_GRPINFO_CACHES \ (EXT4_MAX_BLOCK_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE + 1) -static struct kmem_cache *ext4_groupinfo_caches[NR_GRPINFO_CACHES]; + +static struct { + /* memory cache */ + struct kmem_cache *cache; + /* name of the cache */ + char* cache_name; +} ext4_groupinfo_caches[NR_GRPINFO_CACHES]; static void ext4_mb_generate_from_pa(struct super_block *sb, void *bitmap, ext4_group_t group); @@ -2245,7 +2251,7 @@ static const struct file_operations ext4_mb_seq_groups_fops = { static struct kmem_cache *get_groupinfo_cache(int blocksize_bits) { int cache_index = blocksize_bits - EXT4_MIN_BLOCK_LOG_SIZE; - struct kmem_cache *cachep = ext4_groupinfo_caches[cache_index]; + struct kmem_cache *cachep = ext4_groupinfo_caches[cache_index].cache; BUG_ON(!cachep); return cachep; @@ -2441,7 +2447,7 @@ int ext4_mb_init(struct super_block *sb, int needs_recovery) } cache_index = sb->s_blocksize_bits - EXT4_MIN_BLOCK_LOG_SIZE; - cachep = ext4_groupinfo_caches[cache_index]; + cachep = ext4_groupinfo_caches[cache_index].cache; if (!cachep) { char name[32]; int len = offsetof(struct ext4_group_info, @@ -2462,7 +2468,8 @@ int ext4_mb_init(struct super_block *sb, int needs_recovery) ret = -ENOMEM; goto out; } - ext4_groupinfo_caches[cache_index] = cachep; + ext4_groupinfo_caches[cache_index].cache = cachep; + ext4_groupinfo_caches[cache_index].cache_name = namep; } /* order 0 is regular bitmap */ @@ -2745,12 +2752,13 @@ void ext4_exit_mballoc(void) kmem_cache_destroy(ext4_free_ext_cachep); for (i = 0; i < NR_GRPINFO_CACHES; i++) { - struct kmem_cache *cachep = ext4_groupinfo_caches[i]; - if (cachep) { - char *name = (char *)kmem_cache_name(cachep); + struct kmem_cache *cachep = ext4_groupinfo_caches[i].cache; + char *name = ext4_groupinfo_caches[i].cache_name; + + if (cachep) kmem_cache_destroy(cachep); + if (name) kfree(name); - } } ext4_remove_debugfs_entry(); }