linux-kernel - [PATCH] slab: skip kmemleak_object in leaks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20190508003838.62264-1-cai@lca.pw>
Date:   Tue,  7 May 2019 20:38:38 -0400
From:   Qian Cai <cai@....pw>
To:     akpm@...ux-foundation.org
Cc:     cl@...ux.com, penberg@...nel.org, rientjes@...gle.com,
        iamjoonsoo.kim@....com, catalin.marinas@....com,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        Qian Cai <cai@....pw>
Subject: [PATCH] slab: skip kmemleak_object in leaks_show()

Running tests on a debug kernel will usually generate a large number of
kmemleak objects.

  # grep kmemleak /proc/slabinfo
  kmemleak_object   2243606 3436210 ...

As the result, reading /proc/slab_allocators could easily loop forever
while processing the kmemleak_object cache and any additional freeing or
allocating objects will trigger a reprocessing. To make a situation
worse, soft-lockups could easily happen in this sitatuion which will
call printk() to allocate more kmemleak objects to guarantee a livelock.

Since kmemleak_object has a single call site (create_object()), there
isn't much new information compared with slabinfo. Just skip it.

Signed-off-by: Qian Cai <cai@....pw>
---
 mm/slab.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/mm/slab.c b/mm/slab.c
index 20f318f4f56e..85d1d223f879 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -4285,6 +4285,15 @@ static int leaks_show(struct seq_file *m, void *p)
 	if (!(cachep->flags & SLAB_RED_ZONE))
 		return 0;

+	/*
+	 * /proc/slabinfo has the same information, so skip kmemleak here due to
+	 * a high volume and its RCU free could make cachep->store_user_clean
+	 * dirty all the time.
+	 */
+	if (IS_ENABLED(CONFIG_DEBUG_KMEMLEAK) &&
+	    !strcmp("kmemleak_object", cachep->name))
+		return 0;
+
 	/*
 	 * Set store_user_clean and start to grab stored user information
 	 * for all objects on this cache. If some alloc/free requests comes
-- 
2.20.1 (Apple Git-117)