HEADSUP: UMA not reentrant / possible memory leak

[Tor.Egge at cvsup.no.freebsd.org]

> The indication of this is that the g_bio zone does not return to
> zero USED as it should.

It looks like z->uz_cachefree is slightly out of date (updated in
zone_timout() every 20th second) and often too low (not taking the
z->uz_full_bucket list into account).

The enclosed patch recalculates the number of free elements on the
buckets instead of using z->uz_cachefree.

- Tor Egge

-------------- next part --------------
Index: sys/vm/uma_core.c
===================================================================
RCS file: /home/ncvs/src/sys/vm/uma_core.c,v
retrieving revision 1.63
diff -u -r1.63 uma_core.c
--- sys/vm/uma_core.c	28 Jul 2003 02:29:07 -0000	1.63
+++ sys/vm/uma_core.c	30 Jul 2003 01:05:37 -0000
@@ -2092,6 +2092,10 @@
 	char *tmpbuf, *offset;
 	uma_zone_t z;
 	char *p;
+	int cpu;
+	int cachefree;
+	uma_bucket_t bucket;
+	uma_cache_t cache;
 
 	cnt = 0;
 	mtx_lock(&uma_mtx);
@@ -2112,8 +2116,27 @@
 	LIST_FOREACH(z, &uma_zones, uz_link) {
 		if (cnt == 0)	/* list may have changed size */
 			break;
+		for (cpu = 0; cpu < maxcpu; cpu++) {
+			if (CPU_ABSENT(cpu))
+				continue;
+			CPU_LOCK(cpu);
+		}
 		ZONE_LOCK(z);
-		totalfree = z->uz_free + z->uz_cachefree;
+		cachefree = 0;
+		for (cpu = 0; cpu < maxcpu; cpu++) {
+			if (CPU_ABSENT(cpu))
+				continue;
+			cache = &z->uz_cpu[cpu];
+			if (cache->uc_allocbucket != NULL)
+				cachefree += cache->uc_allocbucket->ub_ptr + 1;
+			if (cache->uc_freebucket != NULL)
+				cachefree += cache->uc_freebucket->ub_ptr + 1;
+			CPU_UNLOCK(cpu);
+		}
+		LIST_FOREACH(bucket, &z->uz_full_bucket, ub_link) {
+			cachefree += bucket->ub_ptr + 1;
+		}
+		totalfree = z->uz_free + cachefree;
 		len = snprintf(offset, linesize,
 		    "%-12.12s  %6.6u, %8.8u, %6.6u, %6.6u, %8.8llu\n",
 		    z->uz_name, z->uz_size,