linux-kernel - Re: kmemleaks on ac3b43283923 ("module: replace module_layout with module

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZDXmq1B2W0h2rrYW@bombadil.infradead.org>
Date:   Tue, 11 Apr 2023 16:00:59 -0700
From:   Luis Chamberlain <mcgrof@...nel.org>
To:     Catalin Marinas <catalin.marinas@....com>
Cc:     Song Liu <song@...nel.org>, jim.cromie@...il.com,
        linux-modules@...r.kernel.org, LKML <linux-kernel@...r.kernel.org>,
        Jason Baron <jbaron@...mai.com>,
        Greg KH <gregkh@...uxfoundation.org>
Subject: Re: kmemleaks on ac3b43283923 ("module: replace module_layout with
 module_memory")

On Tue, Apr 11, 2023 at 10:07:53AM -0700, Luis Chamberlain wrote:
> On Tue, Apr 11, 2023 at 04:10:24PM +0100, Catalin Marinas wrote:
> > On Mon, Apr 03, 2023 at 01:43:58PM -0700, Luis Chamberlain wrote:
> > > On Fri, Mar 31, 2023 at 05:27:04PM -0700, Song Liu wrote:
> > > > On Fri, Mar 31, 2023 at 12:00 AM Luis Chamberlain <mcgrof@...nel.org> wrote:
> > > > > On Thu, Mar 30, 2023 at 04:45:43PM -0600, jim.cromie@...il.com wrote:
> > > > > > kmemleak is reporting 19 leaks during boot
> > > > > >
> > > > > > because the hexdumps appeared to have module-names,
> > > > > > and Ive been hacking nearby, and see the same names
> > > > > > every time I boot my test-vm, I needed a clearer picture
> > > > > > Jason corroborated and bisected.
> > > > > >
> > > > > > the 19 leaks split into 2 groups,
> > > > > > 9 with names of builtin modules in the hexdump,
> > > > > > all with the same backtrace
> > > > > > 9 without module-names (with a shared backtrace)
> > > > > > +1 wo name-ish and a separate backtrace
> > > > >
> > > > > Song, please take a look.
> > > > 
> > > > I will look into this next week.
> > > 
> > > I'm thinking this may be it, at least this gets us to what we used to do
> > > as per original Catalinas' 4f2294b6dc88d ("kmemleak: Add modules
> > > support") and right before Song's patch.
> > > 
> > > diff --git a/kernel/module/main.c b/kernel/module/main.c
> > > index 6b6da80f363f..3b9c71fa6096 100644
> > > --- a/kernel/module/main.c
> > > +++ b/kernel/module/main.c
> > > @@ -2240,7 +2240,10 @@ static int move_module(struct module *mod, struct load_info *info)
> > >  		 * which is inside the block. Just mark it as not being a
> > >  		 * leak.
> > >  		 */
> > > -		kmemleak_ignore(ptr);
> > > +		if (type == MOD_INIT_TEXT)
> > > +			kmemleak_ignore(ptr);
> > > +		else
> > > +			kmemleak_not_leak(ptr);
> > >  		if (!ptr) {
> > >  			t = type;
> > >  			goto out_enomem;
> > > 
> > > We used to use the grey area for the TEXT but the original commit
> > > doesn't explain too well why we grey out init but not the others. Ie
> > > why kmemleak_ignore() on init and kmemleak_not_leak() on the others.
> > 
> > It's safe to use the 'grey' colour in all cases. For text sections that
> > don't need scanning, there's a slight chance of increasing the false
> > negatives, 
> 
> It turns out that there are *tons* of false positives today, unless
> these are real leaks.

I should clarify: *if* we leave things as-is, we seem to get tons of
false positives.

  Luis