From 597fbb8be6021440cd53493c14201c32671bade1 Mon Sep 17 00:00:00 2001 From: Andrew Cooper Date: Fri, 29 Mar 2019 16:17:24 +0000 Subject: [PATCH] xen/timers: Fix memory leak with cpu unplug/plug timer_softirq_action() realloc's itself a larger timer heap whenever necessary, which includes bootstrapping from the empty dummy_heap. Nothing ever freed this allocation. CPU plug and unplug has the side effect of zeroing the percpu data area, which clears ts->heap. This in turn causes new timers to be put on the list rather than the heap, and for timer_softirq_action() to bootstrap itself again. This in practice leaks ts->heap every time a CPU is unplugged and replugged. Implement free_percpu_timers() which includes freeing ts->heap when appropriate, and update the notifier callback with the recent cpu parking logic and free-avoidance across suspend. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- xen/common/timer.c | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/xen/common/timer.c b/xen/common/timer.c index 98f2c4800c..f265a362dd 100644 --- a/xen/common/timer.c +++ b/xen/common/timer.c @@ -615,6 +615,22 @@ static void migrate_timers_from_cpu(unsigned int old_cpu) */ static struct timer *dummy_heap[1]; +static void free_percpu_timers(unsigned int cpu) +{ + struct timers *ts = &per_cpu(timers, cpu); + + migrate_timers_from_cpu(cpu); + + ASSERT(heap_metadata(ts->heap)->size == 0); + if ( heap_metadata(ts->heap)->limit ) + { + xfree(ts->heap); + ts->heap = dummy_heap; + } + else + ASSERT(ts->heap == dummy_heap); +} + static int cpu_callback( struct notifier_block *nfb, unsigned long action, void *hcpu) { @@ -628,10 +644,19 @@ static int cpu_callback( spin_lock_init(&ts->lock); ts->heap = dummy_heap; break; + case CPU_UP_CANCELED: case CPU_DEAD: - migrate_timers_from_cpu(cpu); + case CPU_RESUME_FAILED: + if ( !park_offline_cpus && system_state != SYS_STATE_suspend ) + free_percpu_timers(cpu); break; + + case CPU_REMOVE: + if ( park_offline_cpus ) + free_percpu_timers(cpu); + break; + default: break; } -- 2.30.2