DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:date:message-id:subject:from:to:cc:content-type;
        b=OH473Z88M2cQqDttJYIHRBewTfjVIB/duS+/41DxRjPqUJFhCCQRlxoDFzAzATtemv
         MnEjpAeDq9kBpaVPGgSKPg7Yv5R8abSJ4nYC9xCNTa6hQvv7vLzxnZBBWzy5BCGxyoBr
         QHJkFiOaDHuOWw3J0XG0S5QDNjamMTjeTCAU8=
MIME-Version: 1.0
Date: Wed, 24 Nov 2010 00:15:03 +0100
Message-ID: <AANLkTimkna-R1bhnx6inanobSUye423xqx99nZ27CLBA@mail.gmail.com>
Subject: Inotify memory leak
From: Vegard Nossum <vegard.nossum@gmail.com>
To: Eric Paris <eparis@redhat.com>, Al Viro <viro@zeniv.linux.org.uk>
Cc: LKML <linux-kernel@vger.kernel.org>, Eugene Teo <eugene@redhat.com>
Content-Type: text/plain; charset=UTF-8
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1199
Lines: 47

Hi,

Inotify does not clean up properly when it fails to create the file
descriptor. So it leaks kernel memory. Watch "slabtop" while running
this program:

#include <sys/inotify.h>
#include <unistd.h>

int main(int argc, char *argv[])
{
        int fds[2];

        /* Circumvent max inotify instances limit */
        while (pipe(fds) != -1)
                ;

        while (1)
                inotify_init();

        return 0;
}

Specifically, the problem is in inotify_init1 where the group pointer is leaked:

        group = inotify_new_group(user, inotify_max_queued_events);
[...]
        ret = anon_inode_getfd("inotify", &inotify_fops, group,
                                  O_RDONLY | flags);
        if (ret >= 0)
                return ret;

        atomic_dec(&user->inotify_devs);
out_free_uid:
        free_uid(user);
        return ret;

I think it should be easily fixed by calling fsnotify_put_group() at
the right place.


Vegard
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/