Inotify memory leak

[Vegard Nossum]

Hi,

Inotify does not clean up properly when it fails to create the file
descriptor. So it leaks kernel memory. Watch "slabtop" while running
this program:

#include <sys/inotify.h>
#include <unistd.h>

int main(int argc, char *argv[])
{
int fds[2];

/* Circumvent max inotify instances limit */
while (pipe(fds) != -1)
;

while (1)
inotify_init();

return 0;
}

Specifically, the problem is in inotify_init1 where the group pointer is leaked:

group = inotify_new_group(user, inotify_max_queued_events);
[...]
ret = anon_inode_getfd("inotify", &inotify_fops, group,
O_RDONLY | flags);
if (ret >= 0)
return ret;

atomic_dec(&user->inotify_devs);
out_free_uid:
free_uid(user);
return ret;

I think it should be easily fixed by calling fsnotify_put_group() at
the right place.

Vegard
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majo...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

[Eric Paris]

On Wed, 2010-11-24 at 00:15 +0100, Vegard Nossum wrote:
> Hi,
>
> Inotify does not clean up properly when it fails to create the file
> descriptor. So it leaks kernel memory. Watch "slabtop" while running
> this program:
>
> #include <sys/inotify.h>
> #include <unistd.h>

potential patch at
http://git.infradead.org/users/eparis/notify.git/shortlog/refs/heads/for-next

Only compiled, not tested. Will try to do that after dinner!

-Eric