nexoniarz/SchOS
nexoniarz/SchOS
Watch
1
0
Fork
You've already forked SchOS
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

schfs: the allocation map can be given back, so unmount stops leaking it

Browse source 
Started as "fix the ASAN leak in schfs_objtest" and the test turned out to be
the messenger. The allocation map was taken through a palloc callback and there
was no way to return it: no schfs_space_release, and a comment in
schfs_space_init reading "caller frees what was taken" for an API the caller
did not have.

Three separate leaks from that one gap:

  * The kernel leaked the entire map on every unmount -- up to 2 MB, at 8 KiB
    per GiB of volume -- because kmount_unmount flushed, cleared `mounted` and
    walked away. This is the one that matters; the others are test-only.
  * schfs_space_init stranded a page on its own error path. npages was raised
    only after *both* of a pair of allocations succeeded, so a failure on the
    second left the first outside the count -- unreachable to any cleanup that
    could later exist.
  * schfs_objtest leaked 2121728 bytes in 518 allocations, which is what made
    the whole SchFS suite exit non-zero regardless of its assertions.

The map now carries its own pfree rather than taking one at release time, so it
can only ever be freed by the allocator that filled it -- the kernel's pages
come from kalloc and a host tool's from calloc, and the two are not
interchangeable. schfs_vol_open and schfs_vol_format release any map the volume
is already holding before building another, which is what stops a re-open
leaking; struct schfs_vol must therefore be zeroed before first use, and the
header now says so.

The test's own leak was the last one found and the simplest: it does
memset(&VOL, 0, sizeof(VOL)) before reopening, which wiped the map's pointers
before vol_open could release them. Eight of those, each now releasing first.

schfs_objtest asserts the balance -- 520 pages taken, 520 given back -- because
a suite that leaks cannot detect a leak: the filesystem's own allocations would
arrive as noise inside the harness's. The next one fails the run instead.

make schfs-check now exits 0. The 31 UBSAN misalignment reports are still
there and are still a Gate 0 item.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2
This commit is contained in:
Nexoniarz 2026-09-12 17:49:57 +02:00
commit 25530e7eed
9 changed files with 175 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

56
tools/schfs_objtest.c
View file

@ -81,7 +81,13 @@ md_write(void *ctx, uint64_t b, const void *buf)
static uint64_t md_alloc(void *ctx) { (void)ctx; return schfs_vol_alloc(&VOL); }
static uint64_t md_run(void *ctx, uint64_t n) { (void)ctx; return schfs_vol_alloc_run(&VOL, n); }
static void md_free(void *ctx, uint64_t b) { (void)ctx; schfs_vol_free(&VOL, b); }
static void *md_palloc(void) { return calloc(1, SCHFS_BLKSIZE); }
static long md_pages_taken, md_pages_given;
static void *md_palloc(void) { md_pages_taken++; return calloc(1, SCHFS_BLKSIZE); }
// The matching half. Without it every volume this test opened leaked its whole
// allocation map -- 2121728 bytes across 518 allocations by the end, which made
// the target exit non-zero and drowned any real leak the filesystem might have
// had in expected noise.
static void md_pfree(void *p) { md_pages_given++; free(p); }
static void
mkbdev(struct schfs_bdev *bd)
@ -221,8 +227,9 @@ remount(void)
// Straight back into VOL, not into a local that is then copied over it: a
// schfs_vol points at its own dev field, so a copy of one leaves the tree
// talking to whichever struct it was built in.
memset(&VOL, 0, sizeof(VOL));
if (schfs_vol_open(&VOL, &bd2, &CTX, md_palloc) != 0) {
schfs_space_release(&VOL.space); /* before the memset strands it */
memset(&VOL, 0, sizeof(VOL));
if (schfs_vol_open(&VOL, &bd2, &CTX, md_palloc, md_pfree) != 0) {
printf(" FAIL: remount\n");
failures++;
return ~0ULL;
@ -273,7 +280,7 @@ main(void)
printf("SchFS object-layer test\n\n");
if (schfs_vol_format(&VOL, &bd, NBLOCKS, "objtest", &CTX, md_palloc) != 0) {
if (schfs_vol_format(&VOL, &bd, NBLOCKS, "objtest", &CTX, md_palloc, md_pfree) != 0) {
fprintf(stderr, "FAIL: format\n");
return 1;
}
@ -917,8 +924,9 @@ main(void)
struct schfs_bdev bd3;
mkbdev(&bd3);
schfs_space_release(&VOL.space); /* before the memset strands it */
memset(&VOL, 0, sizeof(VOL));
int r = schfs_vol_open(&VOL, &bd3, &CTX, md_palloc);
int r = schfs_vol_open(&VOL, &bd3, &CTX, md_palloc, md_pfree);
ok(r == 0, "the volume mounts after a crash mid-transaction");
ok(VOL.generation == good_gen,
"it comes back at the last committed generation, not a partial one");
@ -964,9 +972,10 @@ main(void)
for (long cut = 1; cut < 120; cut++) {
memcpy(DISK, saved, NBLOCKS * SCHFS_BLKSIZE);
memset(&VOL, 0, sizeof(VOL));
schfs_space_release(&VOL.space); /* before the memset strands it */
memset(&VOL, 0, sizeof(VOL));
mkbdev(&bd3);
if (schfs_vol_open(&VOL, &bd3, &CTX, md_palloc) != 0) {
if (schfs_vol_open(&VOL, &bd3, &CTX, md_palloc, md_pfree) != 0) {
bad++; break;
}
@ -994,9 +1003,10 @@ main(void)
// Whatever the disk looks like now, all three of these must
// hold: it mounts, it is a whole tree, and the data committed
// before the crash is exactly as it was.
memset(&VOL, 0, sizeof(VOL));
schfs_space_release(&VOL.space); /* before the memset strands it */
memset(&VOL, 0, sizeof(VOL));
mkbdev(&bd3);
if (schfs_vol_open(&VOL, &bd3, &CTX, md_palloc) != 0) {
if (schfs_vol_open(&VOL, &bd3, &CTX, md_palloc, md_pfree) != 0) {
printf(" cut %ld: does not mount\n", cut);
bad++; continue;
}
@ -1040,9 +1050,10 @@ main(void)
// the root. Before the fallback existed the mount simply refused, with
// 127 intact older roots sitting on the disk untouched.
memcpy(DISK, saved, NBLOCKS * SCHFS_BLKSIZE);
schfs_space_release(&VOL.space); /* before the memset strands it */
memset(&VOL, 0, sizeof(VOL));
mkbdev(&bd3);
if (schfs_vol_open(&VOL, &bd3, &CTX, md_palloc) != 0) {
if (schfs_vol_open(&VOL, &bd3, &CTX, md_palloc, md_pfree) != 0) {
printf(" FAIL: reopen for the misdirected-write case\n");
failures++;
} else {
@ -1062,9 +1073,10 @@ main(void)
for (int i = 0; i < 2; i++)
memset(DISK + roots[i] * SCHFS_BLKSIZE, 0xA5, SCHFS_BLKSIZE);
memset(&VOL, 0, sizeof(VOL));
schfs_space_release(&VOL.space); /* before the memset strands it */
memset(&VOL, 0, sizeof(VOL));
mkbdev(&bd3);
int rr = schfs_vol_open(&VOL, &bd3, &CTX, md_palloc);
int rr = schfs_vol_open(&VOL, &bd3, &CTX, md_palloc, md_pfree);
ok(rr == 0, "a volume whose two newest roots are rubbish still mounts");
// Strictly older, not "exactly two older". Copy-on-write shares
// every unchanged node between generations, so a block that is part
@ -1088,19 +1100,35 @@ main(void)
memcpy(DISK, saved, NBLOCKS * SCHFS_BLKSIZE);
memset(DISK + SCHFS_UBER_START * SCHFS_BLKSIZE, 0,
SCHFS_UBER_COUNT * SCHFS_BLKSIZE);
schfs_space_release(&VOL.space); /* before the memset strands it */
memset(&VOL, 0, sizeof(VOL));
mkbdev(&bd3);
ok(schfs_vol_open(&VOL, &bd3, &CTX, md_palloc) != 0,
ok(schfs_vol_open(&VOL, &bd3, &CTX, md_palloc, md_pfree) != 0,
"a volume with no valid uberblock at all is refused, not invented");
// Put the good image back so anything after this runs on a sane volume.
memcpy(DISK, saved, NBLOCKS * SCHFS_BLKSIZE);
schfs_space_release(&VOL.space); /* before the memset strands it */
memset(&VOL, 0, sizeof(VOL));
mkbdev(&bd3);
schfs_vol_open(&VOL, &bd3, &CTX, md_palloc);
schfs_vol_open(&VOL, &bd3, &CTX, md_palloc, md_pfree);
free(saved);
}
// The last volume opened is still holding its map. Nothing else will take
// it, and a test that leaks cannot detect a leak: the filesystem's own
// allocations would arrive as noise inside this one.
schfs_space_release(&VOL.space);
if (md_pages_taken != md_pages_given) {
printf(" [FAIL] %ld allocation-map pages taken, %ld given back\n",
md_pages_taken, md_pages_given);
failures++;
} else {
printf(" [ok] every allocation-map page was given back (%ld)\n",
md_pages_taken);
}
printf("\n%s\n", failures ? "FAILED" : "all checks passed");
return failures ? 1 : 0;
}