Re: 2.6.22-stable causes oomkiller to be invoked

[Tejun Heo <htejun@gmail.com>]

Dhaval Giani wrote:
> On Thu, Dec 13, 2007 at 10:16:58PM +0530, Dhaval Giani wrote:
>> On Thu, Dec 13, 2007 at 08:29:36AM -0800, Greg KH wrote:
>>> On Thu, Dec 13, 2007 at 08:48:47PM +0530, Dhaval Giani wrote:
>>>> On Thu, Dec 13, 2007 at 06:53:26PM +0530, Dhaval Giani wrote:
>>>>> On Thu, Dec 13, 2007 at 06:03:33PM +0530, Dhaval Giani wrote:
>>>>>> Hi Greg, Tejun,
>>>>>>
>>>>>> The following script causes oomkiller to be invoked on my system here.
>>>>>>
>>>>>> while echo; do cat /sys/kernel/kexec_crash_loaded; done
>>>>>>
>>>>>  while echo; do cat /sys/kernel/uevent_seqnum ; done;
>>>>>
>>>>> causes oomkiller to be invoked on 2.6.22-stable, 2.6.23-stable and
>>>>> 2.6.24-rc5 as well. It seems not be particularly related to any single
>>>>> file in sysfs.
>>>>>
>>>> And on 2.6.24-rc5-mm1 as well.
>>> How long do you have to run this?  I'm not seeing a problem here with
>>> 2.6.24-rc5 using SLUB, but I might not have run things long enough.
>>>
>> I hit it reliably under 10 mins. I've seen it with both SLUB and SLAB.
>>
>>> I ran slabinfo and don't see anything leaking either, do you?
>> Nor could I find anything, at least nothing directly apparent. (But, I
>> am not very good at ready slabinfo yet.)
>>
>> I've attached the .config if that helps in reproducing it. (Am testing
>> with SLUB again on latest -mm).
>>
> 
> OK, so it ooms there as well. I am attaching its config and part of the
> dmesg (whatever I could capture).

I can't reproduce it here either.  Please apply the attached patch and
reproduce the problem.  It will report the number of allocated buffer
pages every 10 sec.  After oom occurs, please report how this number
changed and the result of 'cat /proc/slabinfo'.

Thanks.

-- 
tejun

diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index 4045bdc..6e7fa62 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -17,9 +17,30 @@
 #include <linux/list.h>
 #include <linux/mutex.h>
 #include <asm/uaccess.h>
+#include <linux/jiffies.h>
+#include <asm/atomic.h>
 
 #include "sysfs.h"
 
+static unsigned long last_jiffies = INITIAL_JIFFIES;
+static atomic_t sysfs_page_cnt = ATOMIC_INIT(0);
+
+static void sysfs_page_inc(void)
+{
+	atomic_inc(&sysfs_page_cnt);
+
+	if (time_before(jiffies, last_jiffies + 10 * HZ))
+		return;
+
+	last_jiffies = jiffies;
+	printk("XXX sysfs_page_cnt=%d\n", atomic_read(&sysfs_page_cnt));
+}
+
+static void sysfs_page_dec(void)
+{
+	atomic_dec(&sysfs_page_cnt);
+}
+
 #define to_sattr(a) container_of(a,struct subsys_attribute, attr)
 
 /*
@@ -105,8 +126,10 @@ static int fill_read_buffer(struct dentry * dentry, struct sysfs_buffer * buffer
 	int ret = 0;
 	ssize_t count;
 
-	if (!buffer->page)
+	if (!buffer->page) {
 		buffer->page = (char *) get_zeroed_page(GFP_KERNEL);
+		sysfs_page_inc();
+	}
 	if (!buffer->page)
 		return -ENOMEM;
 
@@ -188,8 +211,10 @@ fill_write_buffer(struct sysfs_buffer * buffer, const char __user * buf, size_t
 {
 	int error;
 
-	if (!buffer->page)
+	if (!buffer->page) {
 		buffer->page = (char *)get_zeroed_page(GFP_KERNEL);
+		sysfs_page_inc();
+	}
 	if (!buffer->page)
 		return -ENOMEM;
 
@@ -434,8 +459,10 @@ static int sysfs_release(struct inode *inode, struct file *filp)
 
 	sysfs_put_open_dirent(sd, buffer);
 
-	if (buffer->page)
+	if (buffer->page) {
 		free_page((unsigned long)buffer->page);
+		sysfs_page_dec();
+	}
 	kfree(buffer);
 
 	return 0;