Re: Memory Leaks or Mem. being misreported

[Reco <recoverym4n@enotuniq.net>]

	Hi.

On Sun, Mar 29, 2020 at 05:06:01PM +0200, nito@dismail.de wrote:
> On Sat, Mar 28, 2020 at 05:10:07PM +0300, Reco wrote: 
> > /proc/meminfo (please *do not soft* it), and the output of slabtop.
> > If you're need to understand where all that memory gone - you're in need
> > of proper tools.
> 
> I have saved the output of slabtop and /proc/meminfo for:
>  aboot: Directly after booting and logging into a graphical i3-session

Nothing to see here, but a good baseline.

>  afirefox: After using an affected Firefox profile

Ok, let's breakdown it (left is aboot, right is afirefox).
Here we see about 2Gb of memory consumed:

MemFree:        32124660 kB / MemFree:        30144704 kB

Such discrepancy can be attributed, first, to the difference in Active
and Inactive memory pages:

  Active:           216940 kB / 766788 kB                                    
  Inactive:         178292 kB / 676072 kB

With the most contribution is given by file-backed memory pages (i.e.
filesystem cache):

  Active(file):      94220 kB / 589536 kB                                    
  Inactive(file):   167528 kB / 665180 kB

Which gives us 992988 kB difference of 1979956 kB.

And we see some miniscule tmpfs usage (54532 kB):

Active(anon):     122720 kB / Active(anon):     177252 kB
Inactive(anon):    10892 kB / Inactive(anon):    10764 kB


Second, assorted kernel structures (KReclaim - WritebackTmp per meminfo)
give us 155694 kB.

Third, assorted processes (AnonPages + Mapped + AnonHugePages) give us
another 108360 kB.


> In all cases only some daemons, X-Server, i3 and one or two terminals were 
> running.
> htop and free were reporting memory usage as around 450MiB for aboot and afill-* 
> and around 1,3GiB for afirefox.

Summing it up, it gives us 668382 kB of discrepancy. Note that both htop
and free blatantly lied about actual memory usage, sweetening the deal
for about 350M.



>  afill-alloc: After afirefox and running a simple C program that allocates 
>               almost all of the total physical memory
>  afill-alloc+swaponoff: After afill-alloc and swapoff and swapon.

Too lazy to write it up, I leave it as an exercise to another reader.


So the big question is - where 650M of memory gone? My money is on
kernel modules. Maybe it's Intel's VideoRAM steal (don't know if AMD do
it the same way). Maybe it's some proprietary kernel module.

I know no way of accounting memory usage of kernel module, but I can
spot some possible candidates from "lsmod" output.

Reco