[PATCH] lost path_put in perf_fill_ns_link_info

[PATCH] lost path_put in perf_fill_ns_link_info

[Vasily Averin]

Fixes: commit e422267322cd ("perf: Add PERF_RECORD_NAMESPACES to include namespaces related info")
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
---
 kernel/events/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 10cdb9c..ab5ac84 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -6756,6 +6756,7 @@ static void perf_fill_ns_link_info(struct perf_ns_link_info *ns_link_info,
 		ns_inode = ns_path.dentry->d_inode;
 		ns_link_info->dev = new_encode_dev(ns_inode->i_sb->s_dev);
 		ns_link_info->ino = ns_inode->i_ino;
+		path_put(&ns_path);
 	}
 }
 
-- 
2.7.4

Re: [PATCH] lost path_put in perf_fill_ns_link_info

[Vasily Averin]

Dear Hari,
I did not found where your patch decreases mnt counter,
it seems for me you have lost path_put in perf_fill_ns_link_info().

Thank you,
	Vasily Averin

On 2017-11-06 09:22, Vasily Averin wrote:
> Fixes: commit e422267322cd ("perf: Add PERF_RECORD_NAMESPACES to include namespaces related info")
> Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
> ---
>  kernel/events/core.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index 10cdb9c..ab5ac84 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -6756,6 +6756,7 @@ static void perf_fill_ns_link_info(struct perf_ns_link_info *ns_link_info,
>  		ns_inode = ns_path.dentry->d_inode;
>  		ns_link_info->dev = new_encode_dev(ns_inode->i_sb->s_dev);
>  		ns_link_info->ino = ns_inode->i_ino;
> +		path_put(&ns_path);
>  	}
>  }
>  
> 

Re: lost path_put in perf_fill_ns_link_info

[Andrei Vagin]

Hi Vasily and all,

The patch looks correct for me. I tried to reproduce this issue and
checked that this patch fixes it. Bellow you can find my test program
and a command line to run it. The problem still exists even with this patch.

$ cat test.c
#define _GNU_SOURCE
#include <sched.h>

int main(int argc, char **argv)
{
	while (1)
		unshare(CLONE_NEWUTS);
	return 0;
}

$ gcc -o test_unshare test.c
$ for i in `seq 10000`; do perf trace -o log unshare -u true; done &
[5] 28766
$ for i in `seq 10000`; do perf trace -o log unshare -u true; done &
[6] 28840

$ echo 3 > /proc/sys/vm/drop_caches | cat /proc/slabinfo | grep dentry
dentry             74848  78660    224   18    1 : tunables    0    0    0 : slabdata   4370   4370      0

$ sleep 10
$ echo 3 > /proc/sys/vm/drop_caches | cat /proc/slabinfo | grep dentry
dentry             75145  79002    224   18    1 : tunables    0    0    0 : slabdata   4389   4389      0

$ sleep 10
$ echo 3 > /proc/sys/vm/drop_caches | cat /proc/slabinfo | grep dentry
dentry             75921  79776    224   18    1 : tunables    0    0    0 : slabdata   4432   4432      0
$ git log --pretty=oneline | head -n 2
c83bceb10b36cef895def4b2dfe0aff6ca7c9784 lost path_put in perf_fill_ns_link_info
8b82a8a7ab53ee1a065ac69c835737a701f46b2e Add linux-next specific files for 20171107

Thanks,
Andrei

On Mon, Nov 06, 2017 at 09:22:18AM +0300, Vasily Averin wrote:
> Fixes: commit e422267322cd ("perf: Add PERF_RECORD_NAMESPACES to include namespaces related info")
> Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
> ---
>  kernel/events/core.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index 10cdb9c..ab5ac84 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -6756,6 +6756,7 @@ static void perf_fill_ns_link_info(struct perf_ns_link_info *ns_link_info,
>  		ns_inode = ns_path.dentry->d_inode;
>  		ns_link_info->dev = new_encode_dev(ns_inode->i_sb->s_dev);
>  		ns_link_info->ino = ns_inode->i_ino;
> +		path_put(&ns_path);
>  	}
>  }
>  

Re: lost path_put in perf_fill_ns_link_info

[Andrei Vagin]

On Tue, Nov 07, 2017 at 11:03:18AM -0800, Andrei Vagin wrote:
> Hi Vasily and all,
> 
> The patch looks correct for me. I tried to reproduce this issue and
> checked that this patch fixes it. Bellow you can find my test program
> and a command line to run it. The problem still exists even with this patch.
> 
> $ cat test.c
> #define _GNU_SOURCE
> #include <sched.h>
> 
> int main(int argc, char **argv)
> {
> 	while (1)
> 		unshare(CLONE_NEWUTS);
> 	return 0;
> }
> 
> $ gcc -o test_unshare test.c
> $ for i in `seq 10000`; do perf trace -o log unshare -u true; done &
> [5] 28766
> $ for i in `seq 10000`; do perf trace -o log unshare -u true; done &
> [6] 28840
> 
> $ echo 3 > /proc/sys/vm/drop_caches | cat /proc/slabinfo | grep dentry
> dentry             74848  78660    224   18    1 : tunables    0    0    0 : slabdata   4370   4370      0
> 
> $ sleep 10
> $ echo 3 > /proc/sys/vm/drop_caches | cat /proc/slabinfo | grep dentry
> dentry             75145  79002    224   18    1 : tunables    0    0    0 : slabdata   4389   4389      0
> 
> $ sleep 10
> $ echo 3 > /proc/sys/vm/drop_caches | cat /proc/slabinfo | grep dentry
> dentry             75921  79776    224   18    1 : tunables    0    0    0 : slabdata   4432   4432      0

Actually here is another issue, and it is reproduced by another script:

for i in `seq 10000`; do perf trace -o /dev/null unshare -u true; done &

And it is due to files what perf creates in /tmp

//tmp/perf-vdso.so-84wDCZ
//tmp/perf-vdso.so-YDfUuX
//tmp/perf-vdso.so-KkTBfU
//tmp/perf-vdso.so-srXfvU
//tmp/perf-vdso.so-QrPscR
//tmp/perf-vdso.so-wlxIZO
//tmp/perf-vdso.so-ur4fBP
//tmp/perf-vdso.so-gBMExN
//tmp/perf-vdso.so-6sCehK
//tmp/perf-vdso.so-cZ4GDK
//tmp/perf-vdso.so-ImQLoH
//tmp/perf-vdso.so-y4rMuF
//tmp/perf-vdso.so-Wx1qIG
//tmp/perf-vdso.so-g5mYOD
...

Do we really need all these files? They all are identical.

[root@fc24 ~]# diff -up /tmp/perf-vdso.so-fnVcRz /tmp/perf-vdso.so-FQGYzh
[root@fc24 ~]# echo $?
0
> $ git log --pretty=oneline | head -n 2
> c83bceb10b36cef895def4b2dfe0aff6ca7c9784 lost path_put in perf_fill_ns_link_info
> 8b82a8a7ab53ee1a065ac69c835737a701f46b2e Add linux-next specific files for 20171107
> 
> Thanks,
> Andrei
> 
> On Mon, Nov 06, 2017 at 09:22:18AM +0300, Vasily Averin wrote:
> > Fixes: commit e422267322cd ("perf: Add PERF_RECORD_NAMESPACES to include namespaces related info")
> > Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
> > ---
> >  kernel/events/core.c | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/kernel/events/core.c b/kernel/events/core.c
> > index 10cdb9c..ab5ac84 100644
> > --- a/kernel/events/core.c
> > +++ b/kernel/events/core.c
> > @@ -6756,6 +6756,7 @@ static void perf_fill_ns_link_info(struct perf_ns_link_info *ns_link_info,
> >  		ns_inode = ns_path.dentry->d_inode;
> >  		ns_link_info->dev = new_encode_dev(ns_inode->i_sb->s_dev);
> >  		ns_link_info->ino = ns_inode->i_ino;
> > +		path_put(&ns_path);
> >  	}
> >  }
> >  

Re: [PATCH] lost path_put in perf_fill_ns_link_info

[Vasily Averin]

On 2017-11-08 15:09, Alexander Shishkin wrote:
> On Mon, Nov 06, 2017 at 09:22:18AM +0300, Vasily Averin wrote:
>> Fixes: commit e422267322cd ("perf: Add PERF_RECORD_NAMESPACES to include namespaces related info")
>> Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
> 
> The change description is missing. One needs to open the source code and
> look for proof of correctness for this patch.

perf_fill_ns_link_info() calls ns_get_path()
it returns ns_path with increased mnt and dentry counters.

Problem is that nodody decrement these counters.

You can call ./perf record --namespaces unshare -m
and look how grows mount counter on nsfs_mnt. 

Re: [PATCH] lost path_put in perf_fill_ns_link_info

[Vasily Averin]

On 2017-11-08 16:04, Vasily Averin wrote:
> On 2017-11-08 15:09, Alexander Shishkin wrote:
>> On Mon, Nov 06, 2017 at 09:22:18AM +0300, Vasily Averin wrote:
>>> Fixes: commit e422267322cd ("perf: Add PERF_RECORD_NAMESPACES to include namespaces related info")
>>> Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
>>
>> The change description is missing. One needs to open the source code and
>> look for proof of correctness for this patch.
> 
> perf_fill_ns_link_info() calls ns_get_path()
> it returns ns_path with increased mnt and dentry counters.
> 
> Problem is that nodody decrement these counters.
> 
> You can call ./perf record --namespaces unshare -m
> and look how grows mount counter on nsfs_mnt. 

Situation is even worse, leaked dentry does not allow to free related namespaces.

[root@localhost ~]# uname -a
Linux localhost.localdomain 4.14.0+ #10 SMP Wed Nov 15 00:31:34 MSK 2017 x86_64 x86_64 x86_64 GNU/Linux

VvS:  without --namespace perf works correctly

[root@localhost ~]# grep namespace /proc/slabinfo
pid_namespace          0      0   2568   12    8 : tunables    0    0    0 : slabdata      0      0      0
user_namespace         0      0    824   39    8 : tunables    0    0    0 : slabdata      0      0      0
net_namespace          0      5   6272    5    8 : tunables    0    0    0 : slabdata      1      1      0
[root@localhost ~]# perf record  -q  unshare -n -U  -p --fork true 
[root@localhost ~]# grep namespace /proc/slabinfo
pid_namespace          0     12   2568   12    8 : tunables    0    0    0 : slabdata      1      1      0
user_namespace         0     39    824   39    8 : tunables    0    0    0 : slabdata      1      1      0
net_namespace          0      5   6272    5    8 : tunables    0    0    0 : slabdata      1      1      0

VvS: with --namespace perf leaks namespaces

[root@localhost ~]# perf record  -q  --namespace unshare -n -U  -p --fork true
[root@localhost ~]# grep namespace /proc/slabinfo
pid_namespace          1     12   2568   12    8 : tunables    0    0    0 : slabdata      1      1      0
user_namespace         1     39    824   39    8 : tunables    0    0    0 : slabdata      1      1      0
net_namespace          1      5   6272    5    8 : tunables    0    0    0 : slabdata      1      1      0

VvS: ... and once again, to be sure

[root@localhost ~]# perf record  -q  --namespace unshare -n -U  -p --fork true
[root@localhost ~]# grep namespace /proc/slabinfo
pid_namespace          2     12   2568   12    8 : tunables    0    0    0 : slabdata      1      1      0
user_namespace         2     39    824   39    8 : tunables    0    0    0 : slabdata      1      1      0
net_namespace          2      5   6272    5    8 : tunables    0    0    0 : slabdata      1      1      0


kmemleak also detects leaks dentry, inode, related structures and namespaces

unreferenced object 0xffff998008e76738 (size 192): <<< dentry
  comm "unshare", pid 1436, jiffies 4294786539 (age 509.114s)
    [<ffffffffbb29f495>] __ns_get_path+0xf5/0x160
    [<ffffffffbb29f5a8>] ns_get_path+0x28/0x50
    [<ffffffffbb1adb00>] perf_fill_ns_link_info+0x20/0x80
    [<ffffffffbb1b1ba7>] perf_event_namespaces.part.101+0xd7/0x120
    [<ffffffffbb09e85d>] copy_process.part.34+0x171d/0x1ae0
    [<ffffffffbb09eddc>] _do_fork+0xcc/0x390
    [<ffffffffbb003a11>] do_syscall_64+0x61/0x170
    [<ffffffffbb86e6fb>] return_from_SYSCALL_64+0x0/0x65
    [<ffffffffffffffff>] 0xffffffffffffffff

unreferenced object 0xffff998008e7c928 (size 600): <<< inode
  comm "unshare", pid 1436, jiffies 4294786539 (age 509.114s)
    [<ffffffffbb286f4e>] new_inode_pseudo+0xe/0x60
    [<ffffffffbb29f3e2>] __ns_get_path+0x42/0x160
    [<ffffffffbb29f5a8>] ns_get_path+0x28/0x50
     ...

unreferenced object 0xffff99800cacd320 (size 40): <<< inode_security_struct
  comm "unshare", pid 1436, jiffies 4294786539 (age 509.114s)
    [<ffffffffbb383876>] security_inode_alloc+0x36/0x50
    [<ffffffffbb284bd5>] inode_init_always+0xf5/0x1d0
    [<ffffffffbb28505b>] alloc_inode+0x2b/0x80
    [<ffffffffbb286f4e>] new_inode_pseudo+0xe/0x60
    [<ffffffffbb29f3e2>] __ns_get_path+0x42/0x160
     ...

unreferenced object 0xffff99800cb88a10 (size 2232): <<< pid_namespace
  comm "unshare", pid 1436, jiffies 4294786439 (age 509.214s)
    [<ffffffffbb0c0104>] create_new_namespaces+0xd4/0x1b0
    [<ffffffffbb0c0359>] unshare_nsproxy_namespaces+0x59/0xb0
    [<ffffffffbb09f415>] SyS_unshare+0x1e5/0x370
    [<ffffffffbb86e673>] entry_SYSCALL_64_fastpath+0x1a/0x7d
    [<ffffffffffffffff>] 0xffffffffffffffff

I've resend the patch as  "[PATCH] memory leaks triggered by perf --namespace"

Thank you,
	Vasily Averin