From patchwork Tue Oct 18 08:05:23 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Krishna Kumar X-Patchwork-Id: 120373 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id BDD9C1007D1 for ; Tue, 18 Oct 2011 19:05:55 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752977Ab1JRIFc (ORCPT ); Tue, 18 Oct 2011 04:05:32 -0400 Received: from e23smtp02.au.ibm.com ([202.81.31.144]:34384 "EHLO e23smtp02.au.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751258Ab1JRIFa (ORCPT ); Tue, 18 Oct 2011 04:05:30 -0400 Received: from d23relay05.au.ibm.com (d23relay05.au.ibm.com [202.81.31.247]) by e23smtp02.au.ibm.com (8.14.4/8.13.1) with ESMTP id p9I7wkWh028224; Tue, 18 Oct 2011 18:58:46 +1100 Received: from d23av02.au.ibm.com (d23av02.au.ibm.com [9.190.235.138]) by d23relay05.au.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id p9I82uMY2093146; Tue, 18 Oct 2011 19:02:56 +1100 Received: from d23av02.au.ibm.com (loopback [127.0.0.1]) by d23av02.au.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id p9I85Qhq031466; Tue, 18 Oct 2011 19:05:27 +1100 Received: from krkumar2.in.ibm.com ([9.77.192.146]) by d23av02.au.ibm.com (8.14.4/8.13.1/NCO v10.0 AVin) with ESMTP id p9I85N6B031395; Tue, 18 Oct 2011 19:05:24 +1100 From: Krishna Kumar To: rusty@rustcorp.com.au, mst@redhat.com Cc: Ian.Campbell@citrix.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, virtualization@lists.linux-foundation.org, davem@davemloft.net, Krishna Kumar Date: Tue, 18 Oct 2011 13:35:23 +0530 Message-Id: <20111018080523.16861.55402.sendpatchset@krkumar2.in.ibm.com> Subject: [PATCH] Fix guest memory leak and panic Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Commit 86ee8130 ("virtionet: convert to SKB paged frag API") introduced a bug in guest. During RX testing, guest runs out of memory within seconds, causing oom-killer; which then panics the system: "Kernel panic - not syncing: Out of memory and no killable processes...". /proc/meminfo just before the panic shows MemFree is a few MB's: MemFree: 1928544 kB (starts here) ... ... MemFree: 27488 kB MemFree: 26248 kB MemFree: 24636 kB MemFree: 22632 kB MemFree: 19580 kB MemFree: 17928 kB MemFree: 15548 kB (Panic) The extra reference to the fragment pages causes those pages to not get freed in skb_release_data(). The following patch fixes the bug. I have not checked if any other converted driver has the same issue. Signed-off-by: Krishna Kumar Acked-by: Ian Campbell --- drivers/net/virtio_net.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff -ruNp org/drivers/net/virtio_net.c new/drivers/net/virtio_net.c --- org/drivers/net/virtio_net.c 2011-10-18 08:49:46.000000000 +0530 +++ new/drivers/net/virtio_net.c 2011-10-18 12:55:32.000000000 +0530 @@ -143,18 +143,15 @@ static void skb_xmit_done(struct virtque static void set_skb_frag(struct sk_buff *skb, struct page *page, unsigned int offset, unsigned int *len) { + int size = min((unsigned)PAGE_SIZE - offset, *len); int i = skb_shinfo(skb)->nr_frags; - skb_frag_t *f; - f = &skb_shinfo(skb)->frags[i]; - f->size = min((unsigned)PAGE_SIZE - offset, *len); - f->page_offset = offset; - __skb_frag_set_page(f, page); + __skb_fill_page_desc(skb, i, page, offset, size); - skb->data_len += f->size; - skb->len += f->size; + skb->data_len += size; + skb->len += size; skb_shinfo(skb)->nr_frags++; - *len -= f->size; + *len -= size; } static struct sk_buff *page_to_skb(struct virtnet_info *vi,