| Message ID | 20190503233526.226272-1-dianders@chromium.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | mmc: block: Fix memory leak in blk-mq when cleaning up | expand |
On Fri, May 03, 2019 at 04:35:26PM -0700, Douglas Anderson wrote: > If I run the following on rk3288-veyron-minnie (a 2GB machine) > > cd /sys/bus/platform/drivers/dwmmc_rockchip > for i in $(seq 1 3000); do > echo "========================" $i > echo ff0f0000.dwmmc > unbind > sleep .5 > echo ff0f0000.dwmmc > bind > while true; do > if [ -e /dev/mmcblk2 ]; then > break; > fi > sleep .1 > done > done > > Then I start OOMing somewhere between iteration 200 and 250. Using > kmemleak, I see reports like: > > unreferenced object 0xe39c5580 (size 64): > comm "kworker/1:0", pid 17, jiffies 4294821091 (age 96.952s) > hex dump (first 32 bytes): > 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > backtrace: > [<ad19d10a>] __kmalloc+0x1ec/0x2dc > [<a28614c3>] blk_mq_alloc_tag_set+0x27c/0x2bc > [<0955ae01>] mmc_init_queue+0xa8/0x2a8 > [<5102b986>] mmc_blk_alloc_req+0xf8/0x2d4 > [<f1c2214f>] mmc_blk_probe+0x4a8/0x6c0 > [<0dfdd9d5>] mmc_bus_probe+0x24/0x28 > > It's pretty clear that we're missing a call to blk_mq_free_tag_set(). > Let's add it. > > Fixes: 81196976ed94 ("mmc: block: Add blk-mq support") > Signed-off-by: Douglas Anderson <dianders@chromium.org> > --- > > drivers/mmc/core/queue.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c > index 7c364a9c4eeb..09071e13282e 100644 > --- a/drivers/mmc/core/queue.c > +++ b/drivers/mmc/core/queue.c > @@ -480,6 +480,8 @@ void mmc_cleanup_queue(struct mmc_queue *mq) > */ > flush_work(&mq->complete_work); > > + blk_mq_free_tag_set(&mq->tag_set); > + > mq->card = NULL; > } > FWIW: Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
On Fri, May 3, 2019 at 4:35 PM Douglas Anderson <dianders@chromium.org> wrote: > > If I run the following on rk3288-veyron-minnie (a 2GB machine) > > cd /sys/bus/platform/drivers/dwmmc_rockchip > for i in $(seq 1 3000); do > echo "========================" $i > echo ff0f0000.dwmmc > unbind > sleep .5 > echo ff0f0000.dwmmc > bind > while true; do > if [ -e /dev/mmcblk2 ]; then > break; > fi > sleep .1 > done > done > > Then I start OOMing somewhere between iteration 200 and 250. Using > kmemleak, I see reports like: > > unreferenced object 0xe39c5580 (size 64): > comm "kworker/1:0", pid 17, jiffies 4294821091 (age 96.952s) > hex dump (first 32 bytes): > 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > backtrace: > [<ad19d10a>] __kmalloc+0x1ec/0x2dc > [<a28614c3>] blk_mq_alloc_tag_set+0x27c/0x2bc > [<0955ae01>] mmc_init_queue+0xa8/0x2a8 > [<5102b986>] mmc_blk_alloc_req+0xf8/0x2d4 > [<f1c2214f>] mmc_blk_probe+0x4a8/0x6c0 > [<0dfdd9d5>] mmc_bus_probe+0x24/0x28 > > It's pretty clear that we're missing a call to blk_mq_free_tag_set(). > Let's add it. > > Fixes: 81196976ed94 ("mmc: block: Add blk-mq support") > Signed-off-by: Douglas Anderson <dianders@chromium.org> Nice one. Reviewed-by: Guenter Roeck <groeck@chromium.org> > --- > > drivers/mmc/core/queue.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c > index 7c364a9c4eeb..09071e13282e 100644 > --- a/drivers/mmc/core/queue.c > +++ b/drivers/mmc/core/queue.c > @@ -480,6 +480,8 @@ void mmc_cleanup_queue(struct mmc_queue *mq) > */ > flush_work(&mq->complete_work); > > + blk_mq_free_tag_set(&mq->tag_set); > + > mq->card = NULL; > } > > -- > 2.21.0.1020.gf2820cf01a-goog >
On Sat, May 4, 2019 at 1:35 AM Douglas Anderson <dianders@chromium.org> wrote: > If I run the following on rk3288-veyron-minnie (a 2GB machine) > > cd /sys/bus/platform/drivers/dwmmc_rockchip > for i in $(seq 1 3000); do > echo "========================" $i > echo ff0f0000.dwmmc > unbind > sleep .5 > echo ff0f0000.dwmmc > bind > while true; do > if [ -e /dev/mmcblk2 ]; then > break; > fi > sleep .1 > done > done > > Then I start OOMing somewhere between iteration 200 and 250. Using > kmemleak, I see reports like: > > unreferenced object 0xe39c5580 (size 64): > comm "kworker/1:0", pid 17, jiffies 4294821091 (age 96.952s) > hex dump (first 32 bytes): > 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > backtrace: > [<ad19d10a>] __kmalloc+0x1ec/0x2dc > [<a28614c3>] blk_mq_alloc_tag_set+0x27c/0x2bc > [<0955ae01>] mmc_init_queue+0xa8/0x2a8 > [<5102b986>] mmc_blk_alloc_req+0xf8/0x2d4 > [<f1c2214f>] mmc_blk_probe+0x4a8/0x6c0 > [<0dfdd9d5>] mmc_bus_probe+0x24/0x28 > > It's pretty clear that we're missing a call to blk_mq_free_tag_set(). > Let's add it. > > Fixes: 81196976ed94 ("mmc: block: Add blk-mq support") > Signed-off-by: Douglas Anderson <dianders@chromium.org> Looks correct to me: Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Yours, Linus Walleij
On 4/05/19 2:35 AM, Douglas Anderson wrote: > If I run the following on rk3288-veyron-minnie (a 2GB machine) > > cd /sys/bus/platform/drivers/dwmmc_rockchip > for i in $(seq 1 3000); do > echo "========================" $i > echo ff0f0000.dwmmc > unbind > sleep .5 > echo ff0f0000.dwmmc > bind > while true; do > if [ -e /dev/mmcblk2 ]; then > break; > fi > sleep .1 > done > done > > Then I start OOMing somewhere between iteration 200 and 250. Using > kmemleak, I see reports like: > > unreferenced object 0xe39c5580 (size 64): > comm "kworker/1:0", pid 17, jiffies 4294821091 (age 96.952s) > hex dump (first 32 bytes): > 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > backtrace: > [<ad19d10a>] __kmalloc+0x1ec/0x2dc > [<a28614c3>] blk_mq_alloc_tag_set+0x27c/0x2bc > [<0955ae01>] mmc_init_queue+0xa8/0x2a8 > [<5102b986>] mmc_blk_alloc_req+0xf8/0x2d4 > [<f1c2214f>] mmc_blk_probe+0x4a8/0x6c0 > [<0dfdd9d5>] mmc_bus_probe+0x24/0x28 > > It's pretty clear that we're missing a call to blk_mq_free_tag_set(). > Let's add it. > > Fixes: 81196976ed94 ("mmc: block: Add blk-mq support") > Signed-off-by: Douglas Anderson <dianders@chromium.org> Same as: https://lore.kernel.org/lkml/20190502190714.181664-1-rrangel@chromium.org/ > --- > > drivers/mmc/core/queue.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c > index 7c364a9c4eeb..09071e13282e 100644 > --- a/drivers/mmc/core/queue.c > +++ b/drivers/mmc/core/queue.c > @@ -480,6 +480,8 @@ void mmc_cleanup_queue(struct mmc_queue *mq) > */ > flush_work(&mq->complete_work); > > + blk_mq_free_tag_set(&mq->tag_set); > + > mq->card = NULL; > } > >
diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c index 7c364a9c4eeb..09071e13282e 100644 --- a/drivers/mmc/core/queue.c +++ b/drivers/mmc/core/queue.c @@ -480,6 +480,8 @@ void mmc_cleanup_queue(struct mmc_queue *mq) */ flush_work(&mq->complete_work); + blk_mq_free_tag_set(&mq->tag_set); + mq->card = NULL; }
If I run the following on rk3288-veyron-minnie (a 2GB machine) cd /sys/bus/platform/drivers/dwmmc_rockchip for i in $(seq 1 3000); do echo "========================" $i echo ff0f0000.dwmmc > unbind sleep .5 echo ff0f0000.dwmmc > bind while true; do if [ -e /dev/mmcblk2 ]; then break; fi sleep .1 done done Then I start OOMing somewhere between iteration 200 and 250. Using kmemleak, I see reports like: unreferenced object 0xe39c5580 (size 64): comm "kworker/1:0", pid 17, jiffies 4294821091 (age 96.952s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ad19d10a>] __kmalloc+0x1ec/0x2dc [<a28614c3>] blk_mq_alloc_tag_set+0x27c/0x2bc [<0955ae01>] mmc_init_queue+0xa8/0x2a8 [<5102b986>] mmc_blk_alloc_req+0xf8/0x2d4 [<f1c2214f>] mmc_blk_probe+0x4a8/0x6c0 [<0dfdd9d5>] mmc_bus_probe+0x24/0x28 It's pretty clear that we're missing a call to blk_mq_free_tag_set(). Let's add it. Fixes: 81196976ed94 ("mmc: block: Add blk-mq support") Signed-off-by: Douglas Anderson <dianders@chromium.org> --- drivers/mmc/core/queue.c | 2 ++ 1 file changed, 2 insertions(+)