linux-kernel - Re: inode leak in 2.6.24?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 19 Feb 2008 17:57:08 +0100
From:	Ferenc Wagner <wferi@...f.hu>
To:	David Chinner <dgc@....com>
Cc:	linux-kernel@...r.kernel.org, wferi@...f.hu
Subject: Re: inode leak in 2.6.24?

David Chinner <dgc@....com> writes:

> On Sat, Feb 16, 2008 at 12:18:58AM +0100, Ferenc Wagner wrote:
>
>> 5 days ago I pulled the git tree (HEAD was
>> 25f666300625d894ebe04bac2b4b3aadb907c861), added two minor patches
>> (the vmsplice fix and the GFS1 exports), compiled and booted the
>> kernel.  Things are working OK, but I noticed that inode usage has
>> been steadily rising since then (see attached graph, unless lost in
>> transit).  The real filesystems used by the machine are XFS.  I wonder
>> if it may be some kind of bug and if yes, whether it has been fixed
>> already.  Feel free to ask for any missing information.
>
> Output of /proc/slabinfo, please. If you could get a sample when the
> machine has just booted, one at the typical post-boot steady state
> as well as one after it has increased well past normal, it would
> help identify what type of inode is increasing differently.
>
> Also, can you tell us what metrics you are graphing (i.e. where
> in /proc or /sys you are getting them from)?

So, I loaded the same kernel on a different machine, but that seems to
exhibit a very similar behaviour.  The machine is absolutely idle,
nobody logged in during this period, though an updatedb ran during
this period.  However, the increase seems steady, not correlated to
cron.daily.

The contents of /proc/sys/fs/inode-nr after reboot was:
4421	95

and now, 13h35m later it's:
146182	0

Find the two slabinfo outputs attached.

View attachment "slabinfo_reboot" of type "text/plain" (18317 bytes)

View attachment "slabinfo_13h" of type "text/plain" (18317 bytes)


The xfs_inode, xfs_vnode and dentry lines show significant increase.
The machine indeed uses XFS as its root filesystem.  Hope this gives
enough clues to narrow down the problem.  I can try other kernels if
needed.
-- 
Regards,
Feri.