Slab memory leak in JFFS2 filesystems

[Johns Daniel]

On Fri, Feb 25, 2011 at 6:38 AM, Artem Bityutskiy <dedekind1 at gmail.com> wrote:
> On Thu, 2011-02-24 at 18:41 -0600, Johns Daniel wrote:
>> I have discovered a kernel memory leak associated with JFFS2
>> filesystems. I have verified the leak in kernels 2.6.28 and 2.6.36 on
>> a Freescale PowerPC board using this script:
>>
>> while :; do FN=$(mktemp /jffs2fs/TMP.XXXXXXXX); \
>>    cat /proc/slabinfo |grep "dentry\|size-64 "; sleep 1; /bin/rm $FN; done
>
> Please, check whether they go away after:
>
> echo 3 > /proc/sys/vm/drop_caches
>
> See Documentation/sysctl/vm.txt for more information about what this
> means.

Thanks for that suggestion, Artem! Here is what I tried:

# grep "dentry\|size-64 " /proc/slabinfo
dentry              1398   1410    128   30    1 : tunables  120   60
  0 : slabdata     47     47      0
size-64             1235   1239     64   59    1 : tunables  120   60
  0 : slabdata     21     21      0
# echo 3 > /proc/sys/vm/drop_caches
# grep "dentry\|size-64 " /proc/slabinfo
dentry               332    780    128   30    1 : tunables  120   60
  0 : slabdata     26     26      0
size-64             1213   1239     64   59    1 : tunables  120   60
  0 : slabdata     21     21      0

Then I ran this script for 10 minutes:
# while :; do FN=$(mktemp /jffs2fs/TMP.XXXXXXXX); \
     grep "dentry\|size-64 " /proc/slabinfo; sleep 1; /bin/rm $FN; done

I wasn't sure whether the effect of the "drop_caches" command was
"persistent". So I ran the command once more:
# echo 3 > /proc/sys/vm/drop_caches

About 20 minutes after I stopped the test script, here is the status:
# grep "dentry\|size-64 " /proc/slabinfo
dentry               387    780    128   30    1 : tunables  120   60
  0 : slabdata     26     26      0
size-64             1865   1888     64   59    1 : tunables  120   60
  0 : slabdata     32     32      0

Clearly, there is some growth in the slabs that cannot be explained. I
will also give you two counterpoints:

1.) If I run this similar test script on the same system, the slab
memory does not grow at all (regardless of the drop_caches setting):

while :; do FN=$(touch /jffs2fs/TMP.XXXXXXXX); \
   grep "dentry\|size-64 " /proc/slabinfo; sleep 1; /bin/rm /data/TMP.*; done

2.) This bug brought one of our production systems in the field to its
knee in less than 3 months. If the memory was reclaimable, I don't
think this slab memory growth would have exhausted available free
memory in the system to the point that other processes were unable to
allocate memory.

Any help would be appreciated!

-- Johns

>
> --
> Best Regards,
> Artem Bityutskiy (Артём Битюцкий)
>
>