linux-kernel - [PATCH v2] mm/page_owner: record and dump free_pid and free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Tue, 14 Nov 2023 16:42:02 +1300
From:   Barry Song <21cnbao@...il.com>
To:     akpm@...ux-foundation.org, linux-mm@...ck.org,
        iamjoonsoo.kim@....com, audra@...hat.com
Cc:     linux-kernel@...r.kernel.org, shikemeng@...weicloud.com,
        quic_yingangl@...cinc.com, 42.hyeyoo@...il.com,
        Barry Song <v-songbaohua@...o.com>
Subject: [PATCH v2] mm/page_owner: record and dump free_pid and free_tgid

While investigating some complex memory allocation and free bugs
especially in multi-processes and multi-threads cases, from time
to time, I feel the free stack isn't sufficient as a page can be
freed by processes or threads other than the one allocating it.
And other processes and threads which free the page often have
the exactly same free stack with the one allocating the page. We
can't know who free the page only through the free stack though
the current page_owner does tell us the pid and tgid of the one
allocating the page. This makes the bug investigation often hard.

Thus, This patch adds free pid and tgid in page_owner, so that we
can easily figure out if the freeing is crossing processes or
threads.

Signed-off-by: Barry Song <v-songbaohua@...o.com>
---
 -v2:
 add missed free_pid and free_tgid copy in __folio_copy_owner

 mm/page_owner.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/mm/page_owner.c b/mm/page_owner.c
index 4f13ce7d2452..e7eba7688881 100644
--- a/mm/page_owner.c
+++ b/mm/page_owner.c
@@ -32,6 +32,8 @@ struct page_owner {
 	char comm[TASK_COMM_LEN];
 	pid_t pid;
 	pid_t tgid;
+	pid_t free_pid;
+	pid_t free_tgid;
 };
 
 static bool page_owner_enabled __initdata;
@@ -152,6 +154,8 @@ void __reset_page_owner(struct page *page, unsigned short order)
 		page_owner = get_page_owner(page_ext);
 		page_owner->free_handle = handle;
 		page_owner->free_ts_nsec = free_ts_nsec;
+		page_owner->free_pid = current->pid;
+		page_owner->free_tgid = current->tgid;
 		page_ext = page_ext_next(page_ext);
 	}
 	page_ext_put(page_ext);
@@ -253,6 +257,8 @@ void __folio_copy_owner(struct folio *newfolio, struct folio *old)
 	new_page_owner->handle = old_page_owner->handle;
 	new_page_owner->pid = old_page_owner->pid;
 	new_page_owner->tgid = old_page_owner->tgid;
+	new_page_owner->free_pid = old_page_owner->free_pid;
+	new_page_owner->free_tgid = old_page_owner->free_tgid;
 	new_page_owner->ts_nsec = old_page_owner->ts_nsec;
 	new_page_owner->free_ts_nsec = old_page_owner->ts_nsec;
 	strcpy(new_page_owner->comm, old_page_owner->comm);
@@ -495,7 +501,8 @@ void __dump_page_owner(const struct page *page)
 	if (!handle) {
 		pr_alert("page_owner free stack trace missing\n");
 	} else {
-		pr_alert("page last free stack trace:\n");
+		pr_alert("page last free pid %d tgid %d stack trace:\n",
+			  page_owner->free_pid, page_owner->free_tgid);
 		stack_depot_print(handle);
 	}
 
-- 
2.34.1