Re: [PATCH v2 3/3] NFS: Fix a memory leak in nfs_readdir

[Hugh Dickins]

On Wed, 1 Dec 2010, Trond Myklebust wrote:
> On Wed, 2010-12-01 at 08:17 -0800, Linus Torvalds wrote:
> > On Wed, Dec 1, 2010 at 7:36 AM, Trond Myklebust
> > <Trond.Myklebust@xxxxxxxxxx> wrote:
> > >
> > > We need to ensure that the entries in the nfs_cache_array get cleared
> > > when the page is removed from the page cache. To do so, we use the
> > > releasepage address_space operation (which also requires us to set
> > > the Pg_private flag).
> > 
> > So I really think that the whole "releasepage" use in NFS is simply
> > overly complicated and was obviously too subtle.
> > 
> > The whole need for odd return values, for the page lock, and for the
> > addition of clearing the up-to-date bit comes from the fact that this
> > wasn't really what releasepage was designed for.
> > 
> > 'releasepage' was really designed for the filesystem having its own
> > version of 'try_to_free_buffers()', which is just an optimistic "ok,
> > we may be releasing this page, so try to get rid of any IO structures
> > you have cached". It wasn't really a memory management thing.
> > 
> > And the thing is, it looks trivial to do the memory management
> > approach by adding a new callback that gets called after the page is
> > actually removed from the page cache. If we do that, then there are no
> > races with any other users, since we remove things from the page cache
> > atomically wrt page cache lookup. So the need for playing games with
> > page locking and 'uptodate' simply goes away. As does the PG_private
> > thing or the interaction with invalidatepage() etc.
> > 
> > So this is a TOTALLY UNTESTED trivial patch that just adds another
> > callback. Does this work? I dunno. But I get the feeling that instead
> > of having NFS work around the odd semantics that don't actually match
> > what NFS wants, introducing a new callback with much simpler semantics
> > would be simpler for everybody, and avoid the need for subtle code.
> > 
> > Hmm?
> > 
> >                    Linus
> 
> 
> > include/linux/fs.h |    1 +
> >  mm/vmscan.c        |    3 +++
> >  2 files changed, 4 insertions(+), 0 deletions(-)
> > 
> > diff --git a/include/linux/fs.h b/include/linux/fs.h
> > index c9e06cc..090f0ea 100644
> > --- a/include/linux/fs.h
> > +++ b/include/linux/fs.h
> > @@ -602,6 +602,7 @@ struct address_space_operations {
> >         sector_t (*bmap)(struct address_space *, sector_t);
> >         void (*invalidatepage) (struct page *, unsigned long);
> >         int (*releasepage) (struct page *, gfp_t);
> > +       void (*freepage)(struct page *);
> >         ssize_t (*direct_IO)(int, struct kiocb *, const struct iovec
> > *iov,
> >                         loff_t offset, unsigned long nr_segs);
> >         int (*get_xip_mem)(struct address_space *, pgoff_t, int,
> > diff --git a/mm/vmscan.c b/mm/vmscan.c
> > index d31d7ce..1accb01 100644
> > --- a/mm/vmscan.c
> > +++ b/mm/vmscan.c
> > @@ -499,6 +499,9 @@ static int __remove_mapping(struct address_space
> > *mapping, struct page *page)
> >                 mem_cgroup_uncharge_cache_page(page);
> >         }
> >  
> > +       if (mapping->a_ops->freepage)
> > +               mapping->a_ops->freepage(page);
> 
> Hmm... Looking again at the problem, it appears that the same callback
> needs to be added to truncate_complete_page() and
> invalidate_complete_page2(). Otherwise we end up in a situation where
> the page can sometimes be removed from the page cache without calling
> freepage().
> 
> > +
> >         return 1;
> >  
> >  cannot_free:

Yes, I was wondering quite how we would define this ->freepage thing,
if it gets called from one place that removes from page cache and not
from others.

Another minor problem with it: it would probably need to take the
struct address_space *mapping as arg as well as struct page *page:
because by this time page->mapping has been reset to NULL.

But I'm not at all keen on adding a calllback in this very special
frozen-to-0-references place: please let's not do it without an okay
from Nick Piggin (now Cc'ed).

I agree completely with what Linus said originally about how the
page cannot be freed while there's a reference to it, and it should
be possible to work this without your additional page locks.

Your ->releasepage should be able to judge whether the page is likely
(not certain) to be freed - page_count 3? 1 for the page cache, 1 for
the page_private reference, 1 for vmscan's reference, I think.  Then
it can mark !PageUptodate and proceed with freeing the stuff you had
allocated, undo page_has_private and its reference, and return 1 (or
return 0 if it decides to hold on to the page).

If something races in and grabs another reference to prevent removal
from page cache and freeing, then won't read_cache_page(), seeing
!Uptodate, do the right thing and set up the required info again?

Or perhaps I haven't looked far enough, and you do have races which
actually need your page locks, I can see they make it easier to think
about.

But I'd prefer us not to throw in another callback if it's well
workable with the ->releasepage we already have.  (If it helps,
perhaps we could adjust shrink_page_list() to allow for the page
being removed from page cache inside try_to_release_page() - but
I don't think that should be necessary.)

Hugh
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/