linux-kernel - Re: kmemleak false positive?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 25 Jun 2009 16:25:39 +0100
From:	Catalin Marinas <catalin.marinas@....com>
To:	Dave Jones <davej@...hat.com>
Cc:	Linux Kernel <linux-kernel@...r.kernel.org>
Subject: Re: kmemleak false positive?

On Thu, 2009-06-25 at 10:56 -0400, Dave Jones wrote:
> On Thu, Jun 25, 2009 at 10:25:17AM +0100, Catalin Marinas wrote:
>  > > kmemleak:   backtrace:
>  > > kmemleak:     [<c04fd8b3>] kmemleak_alloc+0x193/0x2b8
>  > > kmemleak:     [<c04f5e73>] kmem_cache_alloc+0x11e/0x174
>  > > kmemleak:     [<c0aae5a7>] debug_objects_mem_init+0x63/0x1d9
>  > > kmemleak:     [<c0a86a62>] start_kernel+0x2da/0x38d
>  > > kmemleak:     [<c0a86090>] i386_start_kernel+0x7f/0x98
>  > > kmemleak:     [<ffffffff>] 0xffffffff
>  > 
>  > It could be a false positive. Do you get some "kmemleak: referenced"
>  > messages as well at a later time? In this case, it is just transient
>  > "leak", caused maybe by pointers stored on the stack or registers.
> 
> Yes, some time later.
[...]
> Hmm, it's pretty noisy, and everything it's found so far looks to be
> a false positive.

In this case, it would make sense to enable task stacks scanning by
default:

diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 17096d1..a38418a 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -194,7 +194,7 @@ static unsigned long jiffies_min_age;
 /* delay between automatic memory scannings */
 static signed long jiffies_scan_wait;
 /* enables or disables the task stacks scanning */
-static int kmemleak_stack_scan;
+static int kmemleak_stack_scan = 1;
 /* mutex protecting the memory scanning */
 static DEFINE_MUTEX(scan_mutex);
 /* mutex protecting the access to the /sys/kernel/debug/kmemleak file */

>  > You can mount debugfs on /sys/kerne/debug and read the kmemleak file in
>  > there (it triggers a new scan as well).
> 
> Currently prints the acpi traces I already posted.

If they are still consistently shown with stack=on, it could be a leak.

-- 
Catalin

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/