pidns memory leak

	http://lkml.org/lkml/2009/7/29/406
	http://lkml.org/lkml/2009/7/29/406
	commit 7766755a2f249e7e0dabc5255a0a3d151ff79821
	Author: Andrea Arcangeli <[email protected]>
	Date:   Mon Feb 4 22:29:21 2008 -0800
	commit 7766755a2f249e7e0dabc5255a0a3d151ff79821
	Author: Andrea Arcangeli <[email protected]>
	Date:   Mon Feb 4 22:29:21 2008 -0800
{
	pid_t pid;
	struct stat s;

	if (mount("proc", "/proc", "proc", 0, NULL)) {
		perror("mount");
		return -1;
	}

	pid = fork();
	if (pid < 0) {
		perror("fork");
		return -1;
	}

	if (!pid) {
		poll(0, 0 , -1);
		exit(-1);
	}

	poll(0, 0, -1);

	return 0;
}
{
	long stack_size = sysconf(_SC_PAGESIZE);
 	void *stack = alloca(stack_size) + stack_size;
	return clone(fn, stack, flags | SIGCHLD, arg);
}
{
	pid_t pid;
	struct stat s;
	char path[MAXPATHLEN];

	pid = clonens(child, NULL, CLONE_NEWNS|CLONE_NEWPID);
	if (pid < 0) {
		perror("clone");
		return -1;
	}

	/* yes ugly.*/
	sleep(1);

	/* !! assumption : child of my child is pid + 1 
	 * any reliable simple solution is welcome :) */
	snprintf(path, sizeof(path), "/proc/%d/exe", pid + 1);
	
	if (lstat(path, &s)) {
		perror("lstat");
		exit(-1);
	}

	if (kill(pid, SIGKILL)) {
		perror("kill");
		return -1;
	}

	return 0;
}
	commit 7766755a2f249e7e0dabc5255a0a3d151ff79821
	Author: Andrea Arcangeli <[email protected]>
	Date:   Mon Feb 4 22:29:21 2008 -0800
	> do_exit->release_task->mark_inode_dirty_sync->schedule() (will never
	> come back to run journal_stop)
	commit 7766755a2f249e7e0dabc5255a0a3d151ff79821
	Author: Andrea Arcangeli <[email protected]>
	Date:   Mon Feb 4 22:29:21 2008 -0800
| #include <stdio.h>
| #include <unistd.h>
| #include <stdlib.h>
| #include <sys/prctl.h>
| #include <sys/param.h>
| #include <sys/stat.h>
| #include <sys/poll.h>
| #include <signal.h>
| #include <sched.h>
| 
| #ifndef CLONE_NEWPID
| #  define CLONE_NEWPID            0x20000000
| #endif
| 
| int child(void *arg)
| {
| 	pid_t pid;
| 	struct stat s;
| 
| 	if (mount("proc", "/proc", "proc", 0, NULL)) {
| 		perror("mount");
| 		return -1;
| 	}
| 
| 	pid = fork();
| 	if (pid < 0) {
| 		perror("fork");
| 		return -1;
| 	}
| 
| 	if (!pid) {
| 		poll(0, 0 , -1);
| 		exit(-1);
| 	}
| 
| 	poll(0, 0, -1);
| 
| 	return 0;
| }
| 
| pid_t clonens(int (*fn)(void *), void *arg, int flags)
| {
| 	long stack_size = sysconf(_SC_PAGESIZE);
|  	void *stack = alloca(stack_size) + stack_size;
| 	return clone(fn, stack, flags | SIGCHLD, arg);
| }
| 
| int main(int argc, char *argv[])
| {
| 	pid_t pid;
| 	struct stat s;
| 	char path[MAXPATHLEN];
| 
| 	pid = clonens(child, NULL, CLONE_NEWNS|CLONE_NEWPID);
| 	if (pid < 0) {
| 		perror("clone");
| 		return -1;
| 	}
| 
| 	/* yes ugly.*/
| 	sleep(1);
| 
| 	/* !! assumption : child of my child is pid + 1 
| 	 * any reliable simple solution is welcome :) */
| 	snprintf(path, sizeof(path), "/proc/%d/exe", pid + 1);
| 	
| 	if (lstat(path, &s)) {
| 		perror("lstat");
| 		exit(-1);
| 	}
| 
| 	if (kill(pid, SIGKILL)) {
| 		perror("kill");
| 		return -1;
| 	}
| 
| 	return 0;
| }
	commit 7766755a2f249e7e0dabc5255a0a3d151ff79821
	Author: Andrea Arcangeli <[email protected]>
	Date:   Mon Feb 4 22:29:21 2008 -0800
	> do_exit->release_task->mark_inode_dirty_sync->schedule() (will never
	> come back to run journal_stop)
| Sukadev Bhattiprolu <[email protected]> writes:
| 
| > Andrea,
| >
| > We have been running a leak in child pid namespaces and some early debugging
| > points to the following commit:
| >
| >>> 	commit 7766755a2f249e7e0dabc5255a0a3d151ff79821
| >>> 	Author: Andrea Arcangeli <[email protected]>
| >>> 	Date:   Mon Feb 4 22:29:21 2008 -0800
| >>>
| >
| > Reverting the commit seems to fix the leak but we need to do some more
| > analysis (like the lstat() question Daniel has).
| 
| Yes.
| 
| That entire path is an optimization.  It should not be needed for correct
| operation.  Although it may be responsible for some false positives.
| 
| > However I have a basic question regarding the commit - the log mentions:
| >
| > 	> do_exit->release_task->mark_inode_dirty_sync->schedule() (will never
| > 	> come back to run journal_stop)
| >
| > But release_task() calls shrink_dcache_parent() for a _procfs_ dentry. Does
| > journal_stop() apply to procfs also ?
| 
| The problem when the that PF_EXITING check was introduced is that
| shrink_dcache_parent could shrink dcache entries for other
| filesystems.  Last I looked that is no longer the case and we can
| remove that code.
| Sukadev Bhattiprolu <[email protected]> writes:
| 
| > Andrea,
| >
| > We have been running a leak in child pid namespaces and some early debugging
| > points to the following commit:
| >
| >>> 	commit 7766755a2f249e7e0dabc5255a0a3d151ff79821
| >>> 	Author: Andrea Arcangeli <[email protected]>
| >>> 	Date:   Mon Feb 4 22:29:21 2008 -0800
| >>>
| >
| > Reverting the commit seems to fix the leak but we need to do some more
| > analysis (like the lstat() question Daniel has).
| 
| Yes.
| 
| That entire path is an optimization.  It should not be needed for correct
| operation.  Although it may be responsible for some false positives.
| 
| > However I have a basic question regarding the commit - the log mentions:
| >
| > 	> do_exit->release_task->mark_inode_dirty_sync->schedule() (will never
| > 	> come back to run journal_stop)
| >
| > But release_task() calls shrink_dcache_parent() for a _procfs_ dentry. Does
| > journal_stop() apply to procfs also ?
| 
| The problem when the that PF_EXITING check was introduced is that
| shrink_dcache_parent could shrink dcache entries for other
| filesystems.  Last I looked that is no longer the case and we can
| remove that code.
	commit 7766755a2f249e7e0dabc5255a0a3d151ff79821
	Author: Andrea Arcangeli <[email protected]>
	Date:   Mon Feb 4 22:29:21 2008 -0800
	$ echo 2 > /proc/sys/vm/drop_caches
	size-64           193243 198088     88   44    1 
	dentry            110584 111202    280   14    1 
	inode_cache       107543 107543   4096    1    1 
	size-128           56341  63450    152   25    1 
	size-4096          21107  21107   4096    1    1 
	vm_area_struct     11838  11960    192   20    1 
	size-256           11406  11424    280   14    1 
	size-32             9408   9916     56   67    1 
	size-512            7710   7710   4096    1    1 
	sysfs_dir_cache     5288   5328    104   37    1 
	pid_2                302    336    136   28    1 
	pid_namespace          1      1   4096    1    1 
	nsproxy                1     53     72   53    1 
	size-64           193150 198044     88   44    1 
	dentry            110509 111202    280   14    1 
	inode_cache       107543 107543   4096    1    1 
	size-128           56326  63450    152   25    1 
	size-4096          21107  21107   4096    1    1 
	vm_area_struct     11857  11960    192   20    1 
	size-256           11405  11424    280   14    1 
	size-32             9408   9916     56   67    1 
	size-512            7710   7710   4096    1    1 
	sysfs_dir_cache     5288   5328    104   37    1 
	pid_2                302    336    136   28    1 
	pid_namespace          1      1   4096    1    1 
	nsproxy                1     53     72   53    1

pidns memory leak

Daniel Lezcano

Sukadev Bhattiprolu

Daniel Lezcano

Sukadev Bhattiprolu

Daniel Lezcano

Sukadev Bhattiprolu

Daniel Lezcano

Sukadev Bhattiprolu

Eric W. Biederman

Sukadev Bhattiprolu

Eric W. Biederman

Matt Helsley

Sukadev Bhattiprolu

Daniel Lezcano

Sukadev Bhattiprolu

Andrew Morton

Serge E. Hallyn

Andrew Morton

Cedric Le Goater

Eric W. Biederman

Cedric Le Goater