[lkml]   [2013]   [Nov]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH 3.11 55/66] mm/zswap: bugfix: memory leak when re-swapon
3.11-stable review patch.  If anyone has any objections, please let me know.


From: Weijie Yang <>

commit aa9bca05a467c61dcea4142b2877d5392de5bdce upstream.

zswap_tree is not freed when swapoff, and it got re-kmalloced in swapon,
so a memory leak occurs.

Free the memory of zswap_tree in zswap_frontswap_invalidate_area().

Signed-off-by: Weijie Yang <>
Reviewed-by: Bob Liu <>
Cc: Minchan Kim <>
Reviewed-by: Minchan Kim <>
From: Weijie Yang <>
Subject: [PATCH 3.11 55/66] mm/zswap: bugfix: memory leak when invalidate and reclaim occur concurrently
Signed-off-by: Greg Kroah-Hartman <>

Consider the following scenario:
thread 0: reclaim entry x (get refcount, but not call zswap_get_swap_cache_page)
thread 1: call zswap_frontswap_invalidate_page to invalidate entry x.
finished, entry x and its zbud is not freed as its refcount != 0
now, the swap_map[x] = 0
thread 0: now call zswap_get_swap_cache_page
swapcache_prepare return -ENOENT because entry x is not used any more
zswap_get_swap_cache_page return ZSWAP_SWAPCACHE_NOMEM
zswap_writeback_entry do nothing except put refcount
Now, the memory of zswap_entry x and its zpage leak.

- check the refcount in fail path, free memory if it is not referenced.

- use ZSWAP_SWAPCACHE_FAIL instead of ZSWAP_SWAPCACHE_NOMEM as the fail path
can be not only caused by nomem but also by invalidate.

[ coding-style fixes]
Signed-off-by: Weijie Yang <>
Reviewed-by: Bob Liu <>
Cc: Minchan Kim <>
Cc: <>
Acked-by: Seth Jennings <>

Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>

mm/zswap.c | 4 ++++
1 file changed, 4 insertions(+)

--- a/mm/zswap.c
+++ b/mm/zswap.c
@@ -816,6 +816,10 @@ static void zswap_frontswap_invalidate_a
tree->rbroot = RB_ROOT;
+ zbud_destroy_pool(tree->pool);
+ kfree(tree);
+ zswap_trees[type] = NULL;

static struct zbud_ops zswap_zbud_ops = {

 \ /
  Last update: 2013-11-02 00:01    [W:0.251 / U:8.728 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site