Xen devel - Jun 2008 - [PATCH]Fix memory leak for copy-receiver of netfront

Hi all,

We found the problem of the memory leak when working with copy-
receiver of netfront.

The source of a problem is that the fragment page is not released with 
dev_kfree_skb() because the nr_frags variable of skb is set to 0. 

This is the patch to fix memory leak in netfront.

Signed-off-by: Kazuhiro Suzuki <kaz@jp.fujitsu.com>
Signed-off-by: Hirofumi Tsujimura <tsujimura.hirof@jp.fujitsu.com>
Signed-off-by: Takanori Kasai <kasai.takanori@jp.fujitsu.com>


A guest kernel does panic if attaching and detaching VNIF is repeated.
Because guest memory becomes empty, and OOM killer is run.
It is a log of that time as follows. 

------------------------------------------------------------------------
<dom0 log>
# xm network-attach guest
# xm network-detach guest 0
# xm network-attach guest
# xm network-detach guest 1
... repeat ...
# xm network-attach guest
# xm network-detach guest 179
# xm network-attach guest
# xm network-detach guest 180
Error: Domain ''guest'' does not exist.


<guest log>
# free -m
             total       used       free     shared    buffers     
cached
Mem:           512        504          8          0         23        
174
-/+ buffers/cache:        305        206
Swap:          511          0        511
... repeat ...
# free -m
             total       used       free     shared    buffers     
cached
Mem:           512        509          2          0          0          
1
-/+ buffers/cache:        507          4
Swap:          511         50        461
awk invoked oom-killer: gfp_mask=0x201d2, order=0, oomkilladj=-17

Call Trace:
 [<a00000010001d160>] show_stack+0x40/0xa0
                                sp=e00000001e0a7a70 bsp=e00000001e0a1480
 [<a00000010001d1f0>] dump_stack+0x30/0x60
                                sp=e00000001e0a7c40 bsp=e00000001e0a1468
 [<a00000010011b1b0>] out_of_memory+0xf0/0x780
                                sp=e00000001e0a7c40 bsp=e00000001e0a1430
 [<a000000100121040>] __alloc_pages+0x420/0x540
                                sp=e00000001e0a7cd0 bsp=e00000001e0a13b8
... snip ...
Kernel panic - not syncing: Out of memory and no killable processes...
------------------------------------------------------------------------

Best Regards,

---
Takanori Kasai

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Kasai Takanori wrote:
> Hi all,
>
> We found the problem of the memory leak when working with copy-
> receiver of netfront.
>
> The source of a problem is that the fragment page is not released with 
> dev_kfree_skb() because the nr_frags variable of skb is set to 0. 
>
> This is the patch to fix memory leak in netfront.
>   
This code doesn''t apply to the current 2.6.25 version of netfront.  The
only similar code I could see is:

                skb = np->rx_skbs[id];
                mfn = gnttab_end_foreign_transfer_ref(ref);
                gnttab_release_grant_reference(&np->gref_rx_head, ref);
                np->grant_rx_ref[id] = GRANT_INVALID_REF;

                if (0 == mfn) {
                        skb_shinfo(skb)->nr_frags = 0;
                        dev_kfree_skb(skb);
                        noxfer++;
                        continue;
                }


Would you mind reviewing the 2.6.25 version of netfront to see if it 
needs a patch?

Thanks,
    J

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Hi Jeremy,

I reviewed the 2.6.25 versions of netfront.

First of all, the xennet_release_rx_bufs() function is freeing 
processing of flipping mode. 
Therefore, more memory leaks are generated. 

It is necessary to change to the freeing processing of the copy-receiver 
mode referring to the following patch. 
http://xenbits.xensource.com/linux-2.6.18-xen.hg?rev/41918416db51

And, if this patch that we made is applied, the memory leak will not be 
generated. 

Best Regards,

---
Takanori Kasai

---------- Original Message ----------
>Date:     2008/06/12
>From:     Jeremy Fitzhardinge <jeremy@goop.org>
>To:       Kasai Takanori <kasai.takanori@jp.fujitsu.com>
>Cc:       xen-devel <xen-devel@lists.xensource.com>
>Subject:  Re: [Xen-devel] [PATCH]Fix memory leak for copy-receiver of 
>          netfront
>
>Kasai Takanori wrote:
>> Hi all,
>>
>> We found the problem of the memory leak when working with copy-
>> receiver of netfront.
>>
>> The source of a problem is that the fragment page is not released with 
>> dev_kfree_skb() because the nr_frags variable of skb is set to 0. 
>>
>> This is the patch to fix memory leak in netfront.
>>   
>
>This code doesn''t apply to the current 2.6.25 version of netfront. 
The
>only similar code I could see is:
>
>                skb = np->rx_skbs[id];
>                mfn = gnttab_end_foreign_transfer_ref(ref);
>                gnttab_release_grant_reference(&np->gref_rx_head,
ref);
>                np->grant_rx_ref[id] = GRANT_INVALID_REF;
>
>                if (0 == mfn) {
>                        skb_shinfo(skb)->nr_frags = 0;
>                        dev_kfree_skb(skb);
>                        noxfer++;
>                        continue;
>                }
>
>
>Would you mind reviewing the 2.6.25 version of netfront to see if it 
>needs a patch?
>
>Thanks,
>    J
>
>_______________________________________________
>Xen-devel mailing list
>Xen-devel@lists.xensource.com
>http://lists.xensource.com/xen-devel

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel