BUG : Memory leak in Linux 2.4.2 MIPS SMP kernel

[Krishna Kondaka <krishna@Sanera.net>]

Hi,

	Here is the bug we found in the Linux 2.4.2 MIPS SMP kernel and the
	fix for the bug.
	
1. Summary:
	Memory leak in Linux 2.4.2 MIPS SMP kernel

2. Description:
	Memory leak happens whenever a process is created and destroyed.
	Whatever memory allocated during process creation is not getting
	freed when the process exits. This problem can be easily reproduced
	by writing any program/script which does a lot of process creation
	and termination. my test script is
	
	while true
	do
		cat /proc/meminfo
		ls /bin
		cat /proc/slabinfo
	end
	
	when /proc/slabinfo is printed, we can see that size of 32-byte
	memory chunks growing indefinitely and eventually causing the
	following panic:
	
	kernel BUG at page_alloc.c:75!
Unable to handle kernel paging request at virtual address 00000000, epc == 
8013bcdc, ra == 8013bcdc
Oops in fault.c:do_page_fault, line 172:
$0 : 00000000 10009f00 0000001f 0000000a
$4 : 802afc10 00000001 00000001 00000000
$8 : 802d7636 b0060170 0000001f 0000000d
$12: 00000000 0000001f 10009f00 0000000a
$16: 80329f50 80329f50 00000000 00657a03
$20: 8053000c 806451a0 80b785a0 ffc00000
$24: 802d7617 8036dca1
$28: 8036c000 8036de08 806451a0 8013bcdc
epc    : 000000008013bcdc
Status : 10009f03
Cause  : 1080000c

BadAddr: 00000000ffc00000Process kswapd (pid: 5, stackpage=8036c000)
Stack: 80253434 8025344c 0000004b 00000001 806451a0 00403000 80329f50 00403000
       00000001 00657a03 8053000c 806451a0 80b785a0 ffc00000 806451a0 8013cba8
       00403000 00000000 80329f50 00403000 801395fc 8013967c 00000000 00000000
       00000000 00000000 00000000 00000000 00657a03 00000000 00000000 00000000
       00000000 00000000 00403000 8053000c 00000007 00424000 80b785a0 806451a0
       ffc00000 ...
Call Trace: [<80253434>] [<8025344c>] [<8013cba8>] [<801395fc>] [<8013967c>] 
[<801398b8>]
 [<801399d8>] [<80139ab0>] [<80136a30>] [<8013b42c>] [<80139c1c>] [<80139c24>]
 [<80162fa8>] [<8013b3e8>] [<8013b4a0>] [<8013b524>] [<8013b55c>] [<80107d38>]
 [<80108d9c>] [<80108d8c>]

3. Keywords
	mips, SMP, memory leak

4. Kernel version

	Linux version 2.4.2

5. Output
	(included as part of description)

6. testcase
	(included as part of description)

7. Environment
	7.1 software
		None
	7.2 Processor info
		(NOTE *** cat /proc/cpuinfo does not print information about 
		    both the CPUs ***)
		cpu                     : MIPS
		processor               : 0
		cpu model               : SiByte SB1 V0.1
		BogoMIPS                : 332.59
		processor               : 1
		cpu model               : SiByte SB1 V0.1
		BogoMIPS                : 332.59
		system type             : SiByte unknown
		byteorder               : big endian
		unaligned accesses      : 0
		wait instruction        : no
		microsecond timers      : no
		extra interrupt vector  : yes
		hardware watchpoint     : no
		VCED exceptions         : not available
		VCEI exceptions         : not available
	7.3 Module information
		No modules.
	7.4 Loaded driver and hardware information (/proc/ioports, /proc/iomem)
	
		bash-2.04# cat /proc/ioports
		bash-2.04# cat /proc/iomem
		00000000-0fe94fff : System RAM
		  00100000-00267d77 : Kernel code
		  00299a40-002ad38f : Kernel data
	7.5 PCI information
		No PCI devices attached
	7.6 SCSI information
		No SCSI devices attached
	7.7 Other information

8. Fix

I found that the bug is in destroy_context() in include/asm-mips/mmu_context.h.
destroy_context() is supposed to kfree() the memory that is allocated by
init_new_context() but it is not doing that.

I modified destroy_context as follows:

/*
 * Destroy context related info for an mm_struct that is about
 * to be put to rest.
 */
extern inline void destroy_context(struct mm_struct *mm)
{
#ifdef CONFIG_SMP
        kfree((void *)mm->context);
#else
        /* Nothing to do.  */
#endif
}

And when I tested this I do not see the memory leak any more.


Krishna Kondaka
Sanera Systems Inc.
krishna@sanera.net