Re: 3.14.65: Memory leak when slub_debug is enabled

Re: 3.14.65: Memory leak when slub_debug is enabled

[Christoph Lameter]

On Tue, 29 Mar 2016, Ajay Patel wrote:

> We have custom board with Marvell Armada dual core ARMV7.
> The driver uses buffers from kmalloc-8192 slab heavily.
> When slub_debug is enabled, the kmalloc-8192 active slabs are
> increasing. The slub stats shows  cmpxchg_double_fail and objects_partial
> are increasing too. Eventually system panics on oom.

Hmmm... I thought we fall back to pass through to the page allocator for
order 1 requests? Why is it going through the regular allocator paths?

> Following patch fixes the issue.

Wonder how that could be? Does the __cmpxchg_double work correctly on ARM?

> Has anybody encountered this issue?
> Is this right fix?

Looks like something is screwing around with the page flags because an
order 1 page is a compound page? Can you ensure that order 1 allocs are
using page allocator fallback. See kmalloc_large().

Re: 3.14.65: Memory leak when slub_debug is enabled

[Jesper Dangaard Brouer]

Hi Ajay,

Could you please provide info on kernel .config settings via commands:

 grep HAVE_ALIGNED_STRUCT_PAGE .config
 grep CONFIG_HAVE_CMPXCHG_DOUBLE .config

You can try to further debug your problem by defining SLUB_DEBUG_CMPXCHG
manually in mm/slub.c to get some verbose output on the cmpxchg failures.

Is the "Marvell Armada dual core ARMV7" a 32-bit CPU?

--Jesper

On Tue, 29 Mar 2016 15:32:26 -0700 Ajay Patel <patela@gmail.com> wrote:

> We have custom board with Marvell Armada dual core ARMV7.
> The driver uses buffers from kmalloc-8192 slab heavily.
> When slub_debug is enabled, the kmalloc-8192 active slabs are
> increasing. The slub stats shows  cmpxchg_double_fail and objects_partial
> are increasing too. Eventually system panics on oom.
> 
> Following patch fixes the issue.
> Has anybody encountered this issue?
> Is this right fix?
> 
> I am not in mailing list please cc me.
> 
> Thanks
> Ajay
> 
> 
> --- slub.c.orig Tue Mar 29 11:54:42 2016
> +++ slub.c      Tue Mar 29 15:08:30 2016
> @@ -1562,9 +1562,12 @@
>         void *freelist;
>         unsigned long counters;
>         struct page new;
> +       int retry_count = 0;
> +#define RETRY_COUNT 10
> 
>         lockdep_assert_held(&n->list_lock);
> 
> +again:
>         /*
>          * Zap the freelist and set the frozen bit.
>          * The old freelist is the list of objects for the
> @@ -1587,8 +1590,13 @@
>         if (!__cmpxchg_double_slab(s, page,
>                         freelist, counters,
>                         new.freelist, new.counters,
> -                       "acquire_slab"))
> +                       "acquire_slab")) {
> +               if (retry_count++ < RETRY_COUNT) {
> +                       new.frozen = 0;
> +                       goto again;
> +               }
>                 return NULL;
> +       }
> 
>         remove_partial(n, page);
>         WARN_ON(!freelist);



-- 
Best regards,
  Jesper Dangaard Brouer
  MSc.CS, Principal Kernel Engineer at Red Hat
  Author of http://www.iptv-analyzer.org
  LinkedIn: http://www.linkedin.com/in/brouer