[PATCH] inotify/idr leak fix

Fix a bug which was reported and diagnosed by
Stefan Jones <stefan.jones@churchillrandoms.co.uk>

IDR trees include a cache of idr_layer objects.  There's no way to destroy
this cache, so when we discard an overall idr tree we end up leaking some
memory.

Add and use idr_destroy() for this.  v9fs and infiniband also need to use
idr_destroy() to avoid leaks.

Or, we make the cache global, like radix_tree_preload().  Which is probably
better.  Later.

Cc: Eric Van Hensbergen <ericvh@ericvh.myip.org>
Cc: Roland Dreier <rolandd@cisco.com>
Cc: Robert Love <rml@novell.com>
Cc: John McCutchan <ttb@tentacle.dhs.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/fs/inotify.c b/fs/inotify.c
index a37e9fb1da589fa1457929e2079e176220ad34c0..9fbaebfdf40bef99428d0feaa50d9b69cba234d0 100644 (file)
--- a/fs/inotify.c
+++ b/fs/inotify.c
@@ -176,6 +176,7 @@ static inline void put_inotify_dev(struct inotify_device *dev)
        if (atomic_dec_and_test(&dev->count)) {
                atomic_dec(&dev->user->inotify_devs);
                free_uid(dev->user);
+               idr_destroy(&dev->idr);
                kfree(dev);
        }
 }

diff --git a/include/linux/idr.h b/include/linux/idr.h
index ca3b7e4625769d1333e9d882bab88ff404b96c5d..3d5de45f961b050d9780795c0bb07a34c866911c 100644 (file)
--- a/include/linux/idr.h
+++ b/include/linux/idr.h
@@ -75,4 +75,5 @@ int idr_pre_get(struct idr *idp, unsigned gfp_mask);
 int idr_get_new(struct idr *idp, void *ptr, int *id);
 int idr_get_new_above(struct idr *idp, void *ptr, int starting_id, int *id);
 void idr_remove(struct idr *idp, int id);
+void idr_destroy(struct idr *idp);
 void idr_init(struct idr *idp);

diff --git a/lib/idr.c b/lib/idr.c
index 6415d053e2bfa838e3a95313137d07a944261fd8..d4df21debc4ddb77948206f6091fb27c569e9909 100644 (file)
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -345,6 +345,19 @@ void idr_remove(struct idr *idp, int id)
 }
 EXPORT_SYMBOL(idr_remove);
 
+/**
+ * idr_destroy - release all cached layers within an idr tree
+ * idp: idr handle
+ */
+void idr_destroy(struct idr *idp)
+{
+       while (idp->id_free_cnt) {
+               struct idr_layer *p = alloc_layer(idp);
+               kmem_cache_free(idr_layer_cache, p);
+       }
+}
+EXPORT_SYMBOL(idr_destroy);
+
 /**
  * idr_find - return pointer for given id
  * @idp: idr handle