xfs_growfs_data_private memory leak

Alex Lyakas
2014-07-01T15:06:48Z

Greetings,

It appears that if xfs_growfs_data_private fails during the "new AG headers"
loop, it does not free all the per-AG structures for the new AGs. When XFS
is unmounted later, they are not freed as well, because
xfs_growfs_data_private did not update the "sb_agcount" field, so
xfs_free_perag will not free them. This happens on 3.8.13, but looking at
the latest master branch, it seems to have the same issue.

Code like [1] in xfs_growfs_data, seems to fix the issue.

A follow-up question: if xfs_grows_data_private fails during the loop that
updates all the secondary superblocks, what is the consequence? (I am aware
that in the latest master branch, the loop is not broken on first error, but
attempts to initialize whatever possible). When these secondary superblocks
will get updated? Is there a way to force-update them? Otherwise, what can
be the consequence of leaving them not updated?

Thanks,
Alex.

[1]
/*
* If we had an error, we might have allocated
* PAGs, which are >=sb_agcount. We need to free
* those, because they will not get freed in
* xfs_free_perag().
*/
if (error) {
unsigned int n_pags = 0;
xfs_perag_t* pags[16] = {0};
xfs_agnumber_t start_agno = mp->m_sb.sb_agcount;

do {
unsigned int pag_idx = 0;

spin_lock(&mp->m_perag_lock);
n_pags = radix_tree_gang_lookup(&mp->m_perag_tree, (void**)pags,
start_agno, ARRAY_SIZE(pags));
for (pag_idx = 0; pag_idx < n_pags; ++pag_idx) {
xfs_perag_t *deleted = NULL;

/* for next lookup */
start_agno = pags[pag_idx]->pag_agno + 1;

/* nobody should really be touching these AGs...*/
if (WARN_ON(atomic_read(&pags[pag_idx]->pag_ref) > 0)) {
pags[pag_idx] = NULL;
continue;
}

deleted = radix_tree_delete(&mp->m_perag_tree,
pags[pag_idx]->pag_agno);
ASSERT(deleted == pags[pag_idx]);
}
spin_unlock(&mp->m_perag_lock);

/* now delete all those still marked for deletion */
for (pag_idx = 0; pag_idx < n_pags; ++pag_idx) {
if (pags[pag_idx])
call_rcu(&pags[pag_idx]->rcu_head,
xfs_free_perag_rcu_cb);
}
} while (n_pags > 0);
}

xfs_free_perag_rcu_cb is similar to __xfs_free_perag, but can be called from
other files.