From nobody@FreeBSD.org  Tue Apr 20 04:26:29 2010
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 6B09C106564A
	for <freebsd-gnats-submit@FreeBSD.org>; Tue, 20 Apr 2010 04:26:29 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id 5A3628FC14
	for <freebsd-gnats-submit@FreeBSD.org>; Tue, 20 Apr 2010 04:26:29 +0000 (UTC)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.3/8.14.3) with ESMTP id o3K4QStC021808
	for <freebsd-gnats-submit@FreeBSD.org>; Tue, 20 Apr 2010 04:26:28 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.3/8.14.3/Submit) id o3K4QSpt021807;
	Tue, 20 Apr 2010 04:26:28 GMT
	(envelope-from nobody)
Message-Id: <201004200426.o3K4QSpt021807@www.freebsd.org>
Date: Tue, 20 Apr 2010 04:26:28 GMT
From: Alexey Illarionov <littlesavage@orionet.ru>
To: freebsd-gnats-submit@FreeBSD.org
Subject: kernel memory leak with disabled devd and hw.bus.devctl_disable=1
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         145865
>Category:       kern
>Synopsis:       [kernel] [panic] kernel memory leak with disabled devd and hw.bus.devctl_disable=1
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Apr 20 04:30:05 UTC 2010
>Closed-Date:    Fri Nov 02 22:22:43 UTC 2012
>Last-Modified:  Fri Nov 02 22:22:43 UTC 2012
>Originator:     Alexey Illarionov
>Release:        7.3-STABLE
>Organization:
>Environment:
7.3-STABLE FreeBSD 7.3-STABLE #1: Mon Apr 19 05:25:53 MSD 2010 i386

>Description:
The 7.3-STABLE kernel leaks memory when devd is disabled even when hw.bus.devctl_disable=1.

The same problem exists on recent 8 stable with hw.bus.devctl_queue=0 and hw.bus.devctl_disable=1

I have mpd5 server with about 400 online users. After about month of uptime there was a kernel panic:

panic: kmem_malloc(16384): kmem_map too small: 335544320 total allocated

vmstat points to high bus memory usage:

bus 4891890 191093K       -  4907302  16,32,64,128,1024

>How-To-Repeat:
1. Turn off devd:

# /etc/rc.d/devd stop
# sysctl hw.bus.devctl_disable=1


2. Create some kernel events and watch for memory:

# vmstat -m | awk '$1=="bus"{print $1,$2,$3}'
bus 1053 50K

# for i in `jot - 1 50` ; do ifconfig gre$i create ; ifconfig gre$i destroy ; done
# vmstat -m | awk '$1=="bus"{print $1,$2,$3}'
bus 1153 57K

# for i in `jot - 1 50` ; do ifconfig gre$i create ; ifconfig gre$i destroy ; done
# vmstat -m | awk '$1=="bus"{print $1,$2,$3}'
bus 1254 63K





>Fix:


>Release-Note:
>Audit-Trail:

From: Mateusz Guzik <mjguzik@gmail.com>
To: bug-followup@FreeBSD.org, littlesavage@orionet.ru
Cc:  
Subject: Re: kern/145865: kernel memory leak with disabled devd and 
	hw.bus.devctl_disable=1
Date: Tue, 20 Apr 2010 19:33:28 +0200

 devctl_queue_length is checked twice.
 
 1)
  if (devctl_queue_length == 0)
                 return;
 
 So we leak message passed by the caller.
 
 2)
 mtx_lock(&devsoftc.mtx);
  if (devctl_queue_length == 0) {
                 free(n1->dei_data, M_BUS);
                 free(n1, M_BUS);
                 return;
 }
 
 So we can return with lock held where we shouldn't (or I'm
 misinterpreting something).
 
 How about this patch then:
 http://student.agh.edu.pl/~mjguzik/subr_bus.diff
 
 --
 Mateusz Guzik
State-Changed-From-To: open->feedback 
State-Changed-By: jh 
State-Changed-When: Wed Apr 21 13:00:58 UTC 2010 
State-Changed-Why:  
Probably fixed in r206916. Can you confirm? 

http://www.freebsd.org/cgi/query-pr.cgi?pr=145865 
State-Changed-From-To: feedback->patched 
State-Changed-By: jh 
State-Changed-When: Sat Apr 24 08:31:36 UTC 2010 
State-Changed-Why:  
Fixed in r206916. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=145865 
State-Changed-From-To: patched->closed 
State-Changed-By: eadler 
State-Changed-When: Fri Nov 2 22:22:42 UTC 2012 
State-Changed-Why:  
MFCed/fixed by now or it will never be MFCed 

http://www.freebsd.org/cgi/query-pr.cgi?pr=145865 
>Unformatted:
