Re: [PATCH] memcg: Free spare array to avoid memory leak

On Fri, Mar 09, 2012 at 01:20:16PM +0900, KAMEZAWA Hiroyuki wrote:

On Fri, 09 Mar 2012 12:07:32 +0800
Sha Zhengju [off-list ref] wrote:

quoted

On 03/09/2012 11:40 AM, KAMEZAWA Hiroyuki wrote:

quoted

On Tue,  6 Mar 2012 20:13:24 +0800
Sha Zhengju[off-list ref]  wrote:

quoted

From: Sha Zhengju<redacted>

When the last event is unregistered, there is no need to keep the spare
array anymore. So free it to avoid memory leak.

Signed-off-by: Sha Zhengju<redacted>

---
  mm/memcontrol.c |    6 ++++++
  1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 22d94f5..3c09a84 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c

@@ -4412,6 +4412,12 @@ static void mem_cgroup_usage_unregister_event(struct cgroup *cgrp,
  swap_buffers:
  	/* Swap primary and spare array */
  	thresholds->spare = thresholds->primary;
+	/* If all events are unregistered, free the spare array */
+	if (!new) {
+		kfree(thresholds->spare);
+		thresholds->spare = NULL;
+	}
+

Could you clear thresholds->primary ? I don't like a pointer points to freed memory.

Do you meaning I should set ‘thresholds->primary = NULL‘ ？
But the following rcu_assign_pointer will do this :

+	/* If all events are unregistered, free the spare array */
+	if (!new) {
+		kfree(thresholds->spare);
+		thresholds->spare = NULL;
+	}
+
  	rcu_assign_pointer(thresholds->primary, new);<---------*HERE*

Hm, ok.

Acked-by: KAMEZAWA Hiroyuki <redacted>


BTW, can memory cgroup be destroyed while there are registered events ?

Yes, it can. All eventfds will be closed first. See cgroup_rmdir().

And here's possibility of leak. If we have an eventfd with >1 threasholds
attached to it, mem_cgroup_usage_unregister_event() will leave spare
not freed. And then we destroy cgroup...

Reviewed-by: Kirill A. Shutemov <redacted>

-- 
 Kirill A. Shutemov