[PATCH]Fix memory leak for copy-receiver of netfront

[PATCH]Fix memory leak for copy-receiver of netfront

[Kasai Takanori]

[-- Attachment #1: Mail message body --]
[-- Type: text/plain, Size: 2252 bytes --]

Hi all,

We found the problem of the memory leak when working with copy-
receiver of netfront.

The source of a problem is that the fragment page is not released with 
dev_kfree_skb() because the nr_frags variable of skb is set to 0. 

This is the patch to fix memory leak in netfront.

Signed-off-by: Kazuhiro Suzuki <kaz@jp.fujitsu.com>
Signed-off-by: Hirofumi Tsujimura <tsujimura.hirof@jp.fujitsu.com>
Signed-off-by: Takanori Kasai <kasai.takanori@jp.fujitsu.com>


A guest kernel does panic if attaching and detaching VNIF is repeated.
Because guest memory becomes empty, and OOM killer is run.
It is a log of that time as follows. 

------------------------------------------------------------------------
<dom0 log>
# xm network-attach guest
# xm network-detach guest 0
# xm network-attach guest
# xm network-detach guest 1
... repeat ...
# xm network-attach guest
# xm network-detach guest 179
# xm network-attach guest
# xm network-detach guest 180
Error: Domain 'guest' does not exist.


<guest log>
# free -m
             total       used       free     shared    buffers     
cached
Mem:           512        504          8          0         23        
174
-/+ buffers/cache:        305        206
Swap:          511          0        511
... repeat ...
# free -m
             total       used       free     shared    buffers     
cached
Mem:           512        509          2          0          0          
1
-/+ buffers/cache:        507          4
Swap:          511         50        461
awk invoked oom-killer: gfp_mask=0x201d2, order=0, oomkilladj=-17

Call Trace:
 [<a00000010001d160>] show_stack+0x40/0xa0
                                sp=e00000001e0a7a70 bsp=e00000001e0a1480
 [<a00000010001d1f0>] dump_stack+0x30/0x60
                                sp=e00000001e0a7c40 bsp=e00000001e0a1468
 [<a00000010011b1b0>] out_of_memory+0xf0/0x780
                                sp=e00000001e0a7c40 bsp=e00000001e0a1430
 [<a000000100121040>] __alloc_pages+0x420/0x540
                                sp=e00000001e0a7cd0 bsp=e00000001e0a13b8
... snip ...
Kernel panic - not syncing: Out of memory and no killable processes...
------------------------------------------------------------------------

Best Regards,

---
Takanori Kasai

[-- Attachment #2: fix-netfront-memory-leak.patch --]
[-- Type: application/octet-stream, Size: 834 bytes --]

# HG changeset patch
# User kasai.takanori@jp.fujitsu.com
# Date 1213152670 -32400
# Node ID 34c91cf0ba1419f7660b800e0dcb7a1c335e32be
# Parent  5db911a71eac6b0b19e74398f0750ce12fb1b94b
Fix memory leak for copy-receiver of netfront.

Signed-off-by: Kazuhiro Suzuki <kaz@jp.fujitsu.com> 
Signed-off-by: Hirofumi Tsujimura <tsujimura.hirof@jp.fujitsu.com>
Signed-off-by: Takanori Kasai <kasai.takanori@jp.fujitsu.com>

diff -r 5db911a71eac -r 34c91cf0ba14 drivers/xen/netfront/netfront.c
--- a/drivers/xen/netfront/netfront.c	Tue Jun 10 08:50:39 2008 +0100
+++ b/drivers/xen/netfront/netfront.c	Wed Jun 11 11:51:10 2008 +0900
@@ -1667,7 +1667,6 @@ static void netif_release_rx_bufs_copy(s
 		np->grant_rx_ref[i] = GRANT_INVALID_REF;
 		add_id_to_freelist(np->rx_skbs, i);
 
-		skb_shinfo(skb)->nr_frags = 0;
 		dev_kfree_skb(skb);
 	}
 

[-- Attachment #3: Type: text/plain, Size: 138 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Re: [PATCH]Fix memory leak for copy-receiver of netfront

[Jeremy Fitzhardinge]

Kasai Takanori wrote:
> Hi all,
>
> We found the problem of the memory leak when working with copy-
> receiver of netfront.
>
> The source of a problem is that the fragment page is not released with 
> dev_kfree_skb() because the nr_frags variable of skb is set to 0. 
>
> This is the patch to fix memory leak in netfront.
>   

This code doesn't apply to the current 2.6.25 version of netfront.  The 
only similar code I could see is:

                skb = np->rx_skbs[id];
                mfn = gnttab_end_foreign_transfer_ref(ref);
                gnttab_release_grant_reference(&np->gref_rx_head, ref);
                np->grant_rx_ref[id] = GRANT_INVALID_REF;

                if (0 == mfn) {
                        skb_shinfo(skb)->nr_frags = 0;
                        dev_kfree_skb(skb);
                        noxfer++;
                        continue;
                }


Would you mind reviewing the 2.6.25 version of netfront to see if it 
needs a patch?

Thanks,
    J

Re: [PATCH]Fix memory leak for copy-receiver of netfront

[Kasai Takanori]

Hi Jeremy,

I reviewed the 2.6.25 versions of netfront.

First of all, the xennet_release_rx_bufs() function is freeing 
processing of flipping mode. 
Therefore, more memory leaks are generated. 

It is necessary to change to the freeing processing of the copy-receiver 
mode referring to the following patch. 
http://xenbits.xensource.com/linux-2.6.18-xen.hg?rev/41918416db51

And, if this patch that we made is applied, the memory leak will not be 
generated. 

Best Regards,

---
Takanori Kasai

---------- Original Message ----------
>Date:     2008/06/12
>From:     Jeremy Fitzhardinge <jeremy@goop.org>
>To:       Kasai Takanori <kasai.takanori@jp.fujitsu.com>
>Cc:       xen-devel <xen-devel@lists.xensource.com>
>Subject:  Re: [Xen-devel] [PATCH]Fix memory leak for copy-receiver of 
>          netfront
>
>Kasai Takanori wrote:
>> Hi all,
>>
>> We found the problem of the memory leak when working with copy-
>> receiver of netfront.
>>
>> The source of a problem is that the fragment page is not released with 
>> dev_kfree_skb() because the nr_frags variable of skb is set to 0. 
>>
>> This is the patch to fix memory leak in netfront.
>>   
>
>This code doesn't apply to the current 2.6.25 version of netfront.  The 
>only similar code I could see is:
>
>                skb = np->rx_skbs[id];
>                mfn = gnttab_end_foreign_transfer_ref(ref);
>                gnttab_release_grant_reference(&np->gref_rx_head, ref);
>                np->grant_rx_ref[id] = GRANT_INVALID_REF;
>
>                if (0 == mfn) {
>                        skb_shinfo(skb)->nr_frags = 0;
>                        dev_kfree_skb(skb);
>                        noxfer++;
>                        continue;
>                }
>
>
>Would you mind reviewing the 2.6.25 version of netfront to see if it 
>needs a patch?
>
>Thanks,
>    J
>
>_______________________________________________
>Xen-devel mailing list
>Xen-devel@lists.xensource.com
>http://lists.xensource.com/xen-devel