Re: BUG: bisected: thermald regression (MEMLEAK) in commit c7ff29763989bd09c433f73fae3c1e1c15d9cda4

Re: BUG: bisected: thermald regression (MEMLEAK) in commit c7ff29763989bd09c433f73fae3c1e1c15d9cda4

[srinivas pandruvada]

[-- Attachment #1: Type: text/plain, Size: 6409 bytes --]

Hi Mirsad,

Thanks for the bisect.

On Mon, 2022-10-24 at 15:13 +0200, Mirsad Goran Todorovac wrote:
> Dear all,
> 
> Around Sep 27th 2022 I've noticed in a mainline kernel built with 
> CONFIG_DEBUG_KMEMLEAK=y
> that there actually is a leak:
> 
> > sudo cat /sys/kernel/debug/kmemleak unreferenced object 
> 0xffff8881095f3ee0 (size 80): comm "thermald", pid 837, jiffies 
> 4294896698 (age 9867.428s) hex dump (first 32 bytes): 00 00 00 00 00
> 00 
> 00 00 0d 01 2d 00 00 00 00 00 ..........-..... af 07 01 00 00 c9 ff
> ff 
> 00 00 00 00 00 00 00 00 ................ backtrace:
> [<00000000b50b9dd6>] 
> kmem_cache_alloc+0x184/0x380 [<00000000fa8428c0>] 
> acpi_os_acquire_object+0x2c/0x32 [<000000002cc0099f>] 
> acpi_ps_alloc_op+0x65/0xe6 [<00000000335faf1b>] 
> acpi_ps_get_next_arg+0x842/0x9ed [<000000007afa2dee>] 
> acpi_ps_parse_loop+0x718/0xee1 [<0000000010ce490e>] 
> acpi_ps_parse_aml+0x261/0x7b2 [<00000000278d4c5f>] 
> acpi_ps_execute_method+0x360/0x459 [<00000000ff7ad4ba>] 
> acpi_ns_evaluate+0x595/0x810 [<0000000037ce3488>] 
> acpi_evaluate_object+0x28b/0x5b2 [<000000001a800bbf>] 
> acpi_run_osc+0x209/0x3d0 [<00000000776fbd43>] 
> int3400_thermal_run_osc+0xed/0x180 [int3400_thermal] 
> [<00000000d6ec2302>] current_uuid_store+0x17c/0x1d0 [int3400_thermal]
> [<00000000486cf3e6>] dev_attr_store+0x3e/0x60 [<00000000bf193027>] 
> sysfs_kf_write+0x88/0xa0 [<00000000820b5cce>] 
> kernfs_fop_write_iter+0x1c9/0x270 [<0000000062f8d35e>] 
> vfs_write+0x5a5/0x750 Mr. Pandruvada required a bug bisect from me,
> so I 
> have eventually made one. # first bad commit: 
> [c7ff29763989bd09c433f73fae3c1e1c15d9cda4] thermal: int340x: Update
> OS 

This will say this patch as this patch is calling acpi_run_osc in
response to thermald calls for the first time.

But looking at code, this is freeing the memory allocated by
acpi_run_osc() call chain as any other caller.

	status = acpi_run_osc(handle, &context);
	if (ACPI_SUCCESS(status)) {
		ret = *((u32 *)(context.ret.pointer + 4));
		if (ret != *enable)
			result = -EPERM;

		kfree(context.ret.pointer);
	} else
		result = -EPERM;

There is no kfree when call failed as at other places.
I think you are failing, you can search for "_OSC" in dmesg.
On some Dell systems this OSC setting fails because of some BIOS issue.
May be you are hitting that case.
Just for the sake of test, please apply the diff and see if the issue
is gone.

Thanks,
Srinivas

> policy capability handshake Here is the git bisect log: 
> mtodorov@domac:~/linux/kernel/linux_stable$ git bisect log git bisect
> start # good: [b6abb62daa5511c4a3eaa30cbdb02544d1f10fa2] Linux 5.15.1
> git bisect good b6abb62daa5511c4a3eaa30cbdb02544d1f10fa2 # bad: 
> [e6f4ff3f91251f67b130c29f38673eb5702f88b9] Linux 6.0.3 git bisect bad
> e6f4ff3f91251f67b130c29f38673eb5702f88b9 # good: 
> [8bb7eca972ad531c9b149c0a51ab43a417385813] Linux 5.15 git bisect good
> 8bb7eca972ad531c9b149c0a51ab43a417385813 # bad: 
> [1464677662943738741500a6f16b85d36bbde2be] Merge tag 
> 'platform-drivers-x86-v5.18-1' of 
> git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-
> x86 
> git bisect bad 1464677662943738741500a6f16b85d36bbde2be # good: 
> [8efd0d9c316af470377894a6a0f9ff63ce18c177] Merge tag '5.17-net-next'
> of 
> git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next git
> bisect 
> good 8efd0d9c316af470377894a6a0f9ff63ce18c177 # good: 
> [aaa25a2fa7964d94690f6de5edd7164ca7d76555] Merge 
> git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net git bisect
> good 
> aaa25a2fa7964d94690f6de5edd7164ca7d76555 # bad: 
> [b4bc93bd76d4da32600795cd323c971f00a2e788] Merge tag 'arm-drivers-
> 5.18' 
> of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc git bisect
> bad 
> b4bc93bd76d4da32600795cd323c971f00a2e788 # bad: 
> [ef510682af3dbe2f9cdae7126a1461c94e010967] Merge tag 'f2fs-for-5.18'
> of 
> git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs git bisect
> bad ef510682af3dbe2f9cdae7126a1461c94e010967 # good: 
> [a04b1bf574e1f4875ea91f5c62ca051666443200] Merge tag 'for-
> 5.18/parisc-1' 
> of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux
> git 
> bisect good a04b1bf574e1f4875ea91f5c62ca051666443200 # bad: 
> [b080cee72ef355669cbc52ff55dc513d37433600] Merge tag 
> 'for-5.18/io_uring-statx-2022-03-18' of git://git.kernel.dk/linux-
> block 
> git bisect bad b080cee72ef355669cbc52ff55dc513d37433600 # good: 
> [02b82b02c34321dde10d003aafcd831a769b2a8a] Merge tag 'pm-5.18-rc1' of
> git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm git
> bisect 
> good 02b82b02c34321dde10d003aafcd831a769b2a8a # good: 
> [0e03b8fd29363f2df44e2a7a176d486de550757a] crypto: xilinx - Turn SHA 
> into a tristate and allow COMPILE_TEST git bisect good 
> 0e03b8fd29363f2df44e2a7a176d486de550757a # good: 
> [3e504d2026eb6c8762cd6040ae57db166516824a] random: check for signal
> and 
> try earlier when generating entropy git bisect good 
> 3e504d2026eb6c8762cd6040ae57db166516824a # good: 
> [5e929367468c8f97cd1ffb0417316cecfebef94b] io_uring: terminate manual
> loop iterator loop correctly for non-vecs git bisect good 
> 5e929367468c8f97cd1ffb0417316cecfebef94b # bad: 
> [2d6fc1455f3f383499e013ebc4b19ff49c53c15e] Merge branches 
> 'thermal-powerclamp', 'thermal-int340x' and 'thermal-docs' git bisect
> bad 2d6fc1455f3f383499e013ebc4b19ff49c53c15e # good: 
> [1d6aab36a26ba44b114d7f8a857c430c9e0c32c9] 
> thermal/drivers/ti-soc-thermal: Remove unused function 
> ti_thermal_get_temp() git bisect good 
> 1d6aab36a26ba44b114d7f8a857c430c9e0c32c9 # bad: 
> [c7ff29763989bd09c433f73fae3c1e1c15d9cda4] thermal: int340x: Update
> OS 
> policy capability handshake git bisect bad 
> c7ff29763989bd09c433f73fae3c1e1c15d9cda4 # good: 
> [098c874e20be2a4cee3021aa9b3485ed5e1f4d5b] thermal: Replace 
> acpi_bus_get_device() git bisect good 
> 098c874e20be2a4cee3021aa9b3485ed5e1f4d5b # good: 
> [668f69a5f863b877bc3ae129efe9a80b6f055141] thermal: int340x: Increase
> bitmap size git bisect good 668f69a5f863b877bc3ae129efe9a80b6f055141
> # 
> first bad commit: [c7ff29763989bd09c433f73fae3c1e1c15d9cda4] thermal:
> int340x: Update OS policy capability handshake You have new mail in 
> /var/mail/mtodorov mtodorov@domac:~/linux/kernel/linux_stable$ I was 
> unable to locate the culprit in the patch myself. Thank you very much
> for your attention. I am available for all further questions. Have a 
> nice day :) Regards, |
> 


[-- Attachment #2: free_on_fail.diff --]
[-- Type: text/x-patch, Size: 889 bytes --]

diff --git a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
index db8a6f63657d..63d8313b5cdd 100644
--- a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
+++ b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
@@ -178,6 +178,7 @@ static int int3400_thermal_run_osc(acpi_handle handle, char *uuid_str, int *enab
 	buf[OSC_QUERY_DWORD] = 0;
 	buf[OSC_SUPPORT_DWORD] = *enable;
 
+	context.ret.pointer = NULL;
 	status = acpi_run_osc(handle, &context);
 	if (ACPI_SUCCESS(status)) {
 		ret = *((u32 *)(context.ret.pointer + 4));
@@ -185,8 +186,11 @@ static int int3400_thermal_run_osc(acpi_handle handle, char *uuid_str, int *enab
 			result = -EPERM;
 
 		kfree(context.ret.pointer);
-	} else
+	} else {
+		if (context.ret.pointer)
+			kfree(context.ret.pointer);
 		result = -EPERM;
+	}
 
 	return result;
 }

Re: BUG: bisected: thermald regression (MEMLEAK) in commit c7ff29763989bd09c433f73fae3c1e1c15d9cda4

[Mirsad Goran Todorovac]

Hi Srinivas,

On 24. 10. 2022. 17:51, srinivas pandruvada wrote:
> Hi Mirsad,
>
> Thanks for the bisect.
>
> On Mon, 2022-10-24 at 15:13 +0200, Mirsad Goran Todorovac wrote:
>> Dear all,
>>
>> Around Sep 27th 2022 I've noticed in a mainline kernel built with
>> CONFIG_DEBUG_KMEMLEAK=y
>> that there actually is a leak:
>>
>>> sudo cat /sys/kernel/debug/kmemleak unreferenced object
>> 0xffff8881095f3ee0 (size 80): comm "thermald", pid 837, jiffies
>> 4294896698 (age 9867.428s) hex dump (first 32 bytes): 00 00 00 00 00
>> 00
>> 00 00 0d 01 2d 00 00 00 00 00 ..........-..... af 07 01 00 00 c9 ff
>> ff
>> 00 00 00 00 00 00 00 00 ................ backtrace:
>> [<00000000b50b9dd6>]
>> kmem_cache_alloc+0x184/0x380 [<00000000fa8428c0>]
>> acpi_os_acquire_object+0x2c/0x32 [<000000002cc0099f>]
>> acpi_ps_alloc_op+0x65/0xe6 [<00000000335faf1b>]
>> acpi_ps_get_next_arg+0x842/0x9ed [<000000007afa2dee>]
>> acpi_ps_parse_loop+0x718/0xee1 [<0000000010ce490e>]
>> acpi_ps_parse_aml+0x261/0x7b2 [<00000000278d4c5f>]
>> acpi_ps_execute_method+0x360/0x459 [<00000000ff7ad4ba>]
>> acpi_ns_evaluate+0x595/0x810 [<0000000037ce3488>]
>> acpi_evaluate_object+0x28b/0x5b2 [<000000001a800bbf>]
>> acpi_run_osc+0x209/0x3d0 [<00000000776fbd43>]
>> int3400_thermal_run_osc+0xed/0x180 [int3400_thermal]
>> [<00000000d6ec2302>] current_uuid_store+0x17c/0x1d0 [int3400_thermal]
>> [<00000000486cf3e6>] dev_attr_store+0x3e/0x60 [<00000000bf193027>]
>> sysfs_kf_write+0x88/0xa0 [<00000000820b5cce>]
>> kernfs_fop_write_iter+0x1c9/0x270 [<0000000062f8d35e>]
>> vfs_write+0x5a5/0x750 Mr. Pandruvada required a bug bisect from me,
>> so I
>> have eventually made one. # first bad commit:
>> [c7ff29763989bd09c433f73fae3c1e1c15d9cda4] thermal: int340x: Update
>> OS
> This will say this patch as this patch is calling acpi_run_osc in
> response to thermald calls for the first time.
>
> But looking at code, this is freeing the memory allocated by
> acpi_run_osc() call chain as any other caller.
>
> 	status = acpi_run_osc(handle, &context);
> 	if (ACPI_SUCCESS(status)) {
> 		ret = *((u32 *)(context.ret.pointer + 4));
> 		if (ret != *enable)
> 			result = -EPERM;
>
> 		kfree(context.ret.pointer);
> 	} else
> 		result = -EPERM;
>
> There is no kfree when call failed as at other places.
> I think you are failing, you can search for "_OSC" in dmesg.
> On some Dell systems this OSC setting fails because of some BIOS issue.
> May be you are hitting that case.
> Just for the sake of test, please apply the diff and see if the issue
> is gone.

Thank you for the patch. Unfortunately, when applied to v6.0.3 it didn't 
fix the issue.

marvin@marvin-IdeaPad-3-15ITL6:~$ uname -rms
Linux 6.0.3-18-fix01-mlk+ x86_64
marvin@marvin-IdeaPad-3-15ITL6:~$ sudo bash
[sudo] password for marvin:
root@marvin-IdeaPad-3-15ITL6:/home/marvin# cat /sys/kernel/debug/kmemleak
root@marvin-IdeaPad-3-15ITL6:/home/marvin# echo scan > 
/sys/kernel/debug/kmemleak
root@marvin-IdeaPad-3-15ITL6:/home/marvin# cat /sys/kernel/debug/kmemleak
unreferenced object 0xffff998b030c3370 (size 80):
   comm "thermald", pid 824, jiffies 4294893654 (age 67.080s)
   hex dump (first 32 bytes):
     00 00 00 00 00 00 00 00 0d 01 2d 00 00 00 00 00 ..........-.....
     af 07 01 c0 6f bc ff ff 00 00 00 00 00 00 00 00 ....o...........
   backtrace:
     [<00000000490225c2>] slab_post_alloc_hook+0x80/0x2e0
     [<00000000dc142b33>] kmem_cache_alloc+0x166/0x2e0
     [<00000000168f1071>] acpi_os_acquire_object+0x2c/0x32
     [<00000000fcc615e1>] acpi_ps_alloc_op+0x4a/0x99
     [<00000000fb475bb4>] acpi_ps_get_next_arg+0x611/0x761
     [<000000009048d529>] acpi_ps_parse_loop+0x494/0x8d7
     [<000000005b0bf086>] acpi_ps_parse_aml+0x1bb/0x561
     [<000000007ab7e288>] acpi_ps_execute_method+0x20f/0x2d5
     [<00000000c12fa6b7>] acpi_ns_evaluate+0x34d/0x4f3
     [<000000001be94719>] acpi_evaluate_object+0x180/0x3ae
     [<00000000423a7ad5>] acpi_run_osc+0x128/0x250
     [<0000000040a72af8>] int3400_thermal_run_osc+0x6f/0xc0 
[int3400_thermal]
     [<00000000f8d59987>] current_uuid_store+0xe3/0x120 [int3400_thermal]
     [<000000007e2e2d17>] dev_attr_store+0x14/0x30
     [<00000000b824b589>] sysfs_kf_write+0x38/0x50
     [<00000000beae69c1>] kernfs_fop_write_iter+0x146/0x1d0
root@marvin-IdeaPad-3-15ITL6:/home/marvin#

The build process was as follows:

  1573  10/24/2022 06:41:53 PM  cd linux_stable
  1574  10/24/2022 06:42:03 PM  git checkout v6.0.3
  1575  10/24/2022 06:42:44 PM  cd ..
  1576  10/24/2022 06:42:50 PM  time rm -rf linux_stable_build; time cp 
-rp linux_stable linux_stable_build; \
                     time diff -ur linux_stable linux_stable_build; cd 
linux_stable_build
  1577  10/24/2022 06:46:19 PM  git apply ../thermald-20221024-01.diff
  1578  10/24/2022 06:46:28 PM  vi ../config-5.15.0-50-memleak
  1579  10/24/2022 06:47:08 PM  cp ../config-5.15.0-50-memleak .config
  1580  10/24/2022 06:47:16 PM  make olddefconfig
  1581  10/24/2022 06:48:42 PM  time nice make CC="ccache gcc" 
KBUILD_BUILD_TIMESTAMP="" -j10 deb-pkg; date

I think your patch definitively makes sense, but there's more to this 
than meets the eye :-/

Hope this helps.

Thanks
Mirsad

--
Mirsad Goran Todorovac
Sistem inženjer
Grafički fakultet | Akademija likovnih umjetnosti
Sveučilište u Zagrebu
-- 
System engineer
Faculty of Graphic Arts | Academy of Fine Arts
University of Zagreb, Republic of Croatia
The European Union

Re: BUG: bisected: thermald regression (MEMLEAK) in commit c7ff29763989bd09c433f73fae3c1e1c15d9cda4

[srinivas pandruvada]

On Mon, 2022-10-24 at 20:34 +0200, Mirsad Goran Todorovac wrote:
> Hi Srinivas,
> 
> On 24. 10. 2022. 17:51, srinivas pandruvada wrote:
> > Hi Mirsad,
> > 
> > Thanks for the bisect.
> > 
> > On Mon, 2022-10-24 at 15:13 +0200, Mirsad Goran Todorovac wrote:
> > > Dear all,
> > > 
> > > Around Sep 27th 2022 I've noticed in a mainline kernel built with
> > > CONFIG_DEBUG_KMEMLEAK=y
> > > that there actually is a leak:
> > > 
> > > > sudo cat /sys/kernel/debug/kmemleak unreferenced object
> > > 0xffff8881095f3ee0 (size 80): comm "thermald", pid 837, jiffies
> > > 4294896698 (age 9867.428s) hex dump (first 32 bytes): 00 00 00 00
> > > 00
> > > 00
> > > 00 00 0d 01 2d 00 00 00 00 00 ..........-..... af 07 01 00 00 c9
> > > ff
> > > ff
> > > 00 00 00 00 00 00 00 00 ................ backtrace:
> > > [<00000000b50b9dd6>]
> > > kmem_cache_alloc+0x184/0x380 [<00000000fa8428c0>]
> > > acpi_os_acquire_object+0x2c/0x32 [<000000002cc0099f>]
> > > acpi_ps_alloc_op+0x65/0xe6 [<00000000335faf1b>]
> > > acpi_ps_get_next_arg+0x842/0x9ed [<000000007afa2dee>]
> > > acpi_ps_parse_loop+0x718/0xee1 [<0000000010ce490e>]
> > > acpi_ps_parse_aml+0x261/0x7b2 [<00000000278d4c5f>]
> > > acpi_ps_execute_method+0x360/0x459 [<00000000ff7ad4ba>]
> > > acpi_ns_evaluate+0x595/0x810 [<0000000037ce3488>]
> > > acpi_evaluate_object+0x28b/0x5b2 [<000000001a800bbf>]
> > > acpi_run_osc+0x209/0x3d0 [<00000000776fbd43>]
> > > int3400_thermal_run_osc+0xed/0x180 [int3400_thermal]
> > > [<00000000d6ec2302>] current_uuid_store+0x17c/0x1d0
> > > [int3400_thermal]
> > > [<00000000486cf3e6>] dev_attr_store+0x3e/0x60
> > > [<00000000bf193027>]
> > > sysfs_kf_write+0x88/0xa0 [<00000000820b5cce>]
> > > kernfs_fop_write_iter+0x1c9/0x270 [<0000000062f8d35e>]
> > > vfs_write+0x5a5/0x750 Mr. Pandruvada required a bug bisect from
> > > me,
> > > so I
> > > have eventually made one. # first bad commit:
> > > [c7ff29763989bd09c433f73fae3c1e1c15d9cda4] thermal: int340x:
> > > Update
> > > OS
> > This will say this patch as this patch is calling acpi_run_osc in
> > response to thermald calls for the first time.
> > 
> > But looking at code, this is freeing the memory allocated by
> > acpi_run_osc() call chain as any other caller.
> > 
> >         status = acpi_run_osc(handle, &context);
> >         if (ACPI_SUCCESS(status)) {
> >                 ret = *((u32 *)(context.ret.pointer + 4));
> >                 if (ret != *enable)
> >                         result = -EPERM;
> > 
> >                 kfree(context.ret.pointer);
> >         } else
> >                 result = -EPERM;
> > 
> > There is no kfree when call failed as at other places.
> > I think you are failing, you can search for "_OSC" in dmesg.
> > On some Dell systems this OSC setting fails because of some BIOS
> > issue.
> > May be you are hitting that case.
> > Just for the sake of test, please apply the diff and see if the
> > issue
> > is gone.
> 
> Thank you for the patch. Unfortunately, when applied to v6.0.3 it
> didn't 
> fix the issue.
Thanks for the test. I copied to acpi and acpica mailing list. Someone
can tell us what is this call doing wrong here.

Thanks,
Srinivas

> 
> marvin@marvin-IdeaPad-3-15ITL6:~$ uname -rms
> Linux 6.0.3-18-fix01-mlk+ x86_64
> marvin@marvin-IdeaPad-3-15ITL6:~$ sudo bash
> [sudo] password for marvin:
> root@marvin-IdeaPad-3-15ITL6:/home/marvin# cat
> /sys/kernel/debug/kmemleak
> root@marvin-IdeaPad-3-15ITL6:/home/marvin# echo scan > 
> /sys/kernel/debug/kmemleak
> root@marvin-IdeaPad-3-15ITL6:/home/marvin# cat
> /sys/kernel/debug/kmemleak
> unreferenced object 0xffff998b030c3370 (size 80):
>    comm "thermald", pid 824, jiffies 4294893654 (age 67.080s)
>    hex dump (first 32 bytes):
>      00 00 00 00 00 00 00 00 0d 01 2d 00 00 00 00 00 ..........-.....
>      af 07 01 c0 6f bc ff ff 00 00 00 00 00 00 00 00 ....o...........
>    backtrace:
>      [<00000000490225c2>] slab_post_alloc_hook+0x80/0x2e0
>      [<00000000dc142b33>] kmem_cache_alloc+0x166/0x2e0
>      [<00000000168f1071>] acpi_os_acquire_object+0x2c/0x32
>      [<00000000fcc615e1>] acpi_ps_alloc_op+0x4a/0x99
>      [<00000000fb475bb4>] acpi_ps_get_next_arg+0x611/0x761
>      [<000000009048d529>] acpi_ps_parse_loop+0x494/0x8d7
>      [<000000005b0bf086>] acpi_ps_parse_aml+0x1bb/0x561
>      [<000000007ab7e288>] acpi_ps_execute_method+0x20f/0x2d5
>      [<00000000c12fa6b7>] acpi_ns_evaluate+0x34d/0x4f3
>      [<000000001be94719>] acpi_evaluate_object+0x180/0x3ae
>      [<00000000423a7ad5>] acpi_run_osc+0x128/0x250
>      [<0000000040a72af8>] int3400_thermal_run_osc+0x6f/0xc0 
> [int3400_thermal]
>      [<00000000f8d59987>] current_uuid_store+0xe3/0x120
> [int3400_thermal]
>      [<000000007e2e2d17>] dev_attr_store+0x14/0x30
>      [<00000000b824b589>] sysfs_kf_write+0x38/0x50
>      [<00000000beae69c1>] kernfs_fop_write_iter+0x146/0x1d0
> root@marvin-IdeaPad-3-15ITL6:/home/marvin#
> 
> The build process was as follows:
> 
>   1573  10/24/2022 06:41:53 PM  cd linux_stable
>   1574  10/24/2022 06:42:03 PM  git checkout v6.0.3
>   1575  10/24/2022 06:42:44 PM  cd ..
>   1576  10/24/2022 06:42:50 PM  time rm -rf linux_stable_build; time
> cp 
> -rp linux_stable linux_stable_build; \
>                      time diff -ur linux_stable linux_stable_build;
> cd 
> linux_stable_build
>   1577  10/24/2022 06:46:19 PM  git apply ../thermald-20221024-
> 01.diff
>   1578  10/24/2022 06:46:28 PM  vi ../config-5.15.0-50-memleak
>   1579  10/24/2022 06:47:08 PM  cp ../config-5.15.0-50-memleak
> .config
>   1580  10/24/2022 06:47:16 PM  make olddefconfig
>   1581  10/24/2022 06:48:42 PM  time nice make CC="ccache gcc" 
> KBUILD_BUILD_TIMESTAMP="" -j10 deb-pkg; date
> 
> I think your patch definitively makes sense, but there's more to this
> than meets the eye :-/
> 
> Hope this helps.
> 
> Thanks
> Mirsad
> 
> --
> Mirsad Goran Todorovac
> Sistem inženjer
> Grafički fakultet | Akademija likovnih umjetnosti
> Sveučilište u Zagrebu

Re: BUG: bisected: thermald regression (MEMLEAK) in commit c7ff29763989bd09c433f73fae3c1e1c15d9cda4

[Mirsad Goran Todorovac]

On 24. 10. 2022. 20:39, srinivas pandruvada wrote:

>> Thank you for the patch. Unfortunately, when applied to v6.0.3 it
>> didn't
>> fix the issue.
> Thanks for the test. I copied to acpi and acpica mailing list. Someone
> can tell us what is this call doing wrong here.
Seems like a prudent thing to do. It must be heavy to provide support 
for all of the
hardware on the market ...

Maybe this will help (however, this dmesg -l err was the same in "git 
bisect good" and "git bisect bad" kernels!):

root@marvin-IdeaPad-3-15ITL6:~# dmesg -l err
[    0.121673] ACPI BIOS Error (bug): Could not resolve symbol 
[\_SB.PCI0], AE_NOT_FOUND (20220331/dswload2-163)
[    0.121688] ACPI Error: AE_NOT_FOUND, During name lookup/catalog 
(20220331/psobject-221)
[    0.142742] ACPI BIOS Error (bug): Could not resolve symbol 
[\_SB.PC00.DGPV], AE_NOT_FOUND (20220331/psargs-330)
[    0.142751] ACPI Error: Aborting method \_SB.PC00.PEG0.PCRP._ON due 
to previous error (AE_NOT_FOUND) (20220331/psparse-531)
[    0.308625] integrity: Problem loading X.509 certificate -65
[    2.731846] mtd device must be supplied (device name is empty)
[    3.226997] i801_smbus 0000:00:1f.4: Transaction timeout
[    3.229085] i801_smbus 0000:00:1f.4: Failed terminating the transaction
[    3.229194] i801_smbus 0000:00:1f.4: SMBus is busy, can't use it!
[    3.515909] mtd device must be supplied (device name is empty)
[    4.600624] ACPI BIOS Error (bug): Could not resolve symbol 
[\_TZ.ETMD], AE_NOT_FOUND (20220331/psargs-330)
[    4.600741] ACPI Error: Aborting method \_SB.IETM._OSC due to 
previous error (AE_NOT_FOUND) (20220331/psparse-531)
[    5.110999] Bluetooth: hci0: Malformed MSFT vendor event: 0x02
[    5.173006] Bluetooth: hci0: HCI_REQ-0xfc1e
root@marvin-IdeaPad-3-15ITL6:~# dmesg | grep _OSC
[    0.131652] ACPI: \_SB_.PR00: _OSC native thermal LVT Acked
[    0.167416] acpi PNP0A08:00: _OSC: OS supports [ExtendedConfig ASPM 
ClockPM Segments MSI EDR HPX-Type3]
[    0.169119] acpi PNP0A08:00: _OSC: platform does not support [AER]
[    0.172500] acpi PNP0A08:00: _OSC: OS now controls [PCIeHotplug 
SHPCHotplug PME PCIeCapability LTR DPC]
[    4.600655] No Local Variables are initialized for Method [_OSC]
[    4.600660] Initialized Arguments for Method [_OSC]:  (4 arguments 
defined for method invocation)
[    4.600741] ACPI Error: Aborting method \_SB.IETM._OSC due to 
previous error (AE_NOT_FOUND) (20220331/psparse-531)
root@marvin-IdeaPad-3-15ITL6:~#

>> marvin@marvin-IdeaPad-3-15ITL6:~$ uname -rms
>> Linux 6.0.3-18-fix01-mlk+ x86_64
>> marvin@marvin-IdeaPad-3-15ITL6:~$ sudo bash
>> [sudo] password for marvin:
>> root@marvin-IdeaPad-3-15ITL6:/home/marvin# cat
>> /sys/kernel/debug/kmemleak
>> root@marvin-IdeaPad-3-15ITL6:/home/marvin# echo scan >
>> /sys/kernel/debug/kmemleak
>> root@marvin-IdeaPad-3-15ITL6:/home/marvin# cat
>> /sys/kernel/debug/kmemleak
>> unreferenced object 0xffff998b030c3370 (size 80):
>>     comm "thermald", pid 824, jiffies 4294893654 (age 67.080s)
>>     hex dump (first 32 bytes):
>>       00 00 00 00 00 00 00 00 0d 01 2d 00 00 00 00 00 ..........-.....
>>       af 07 01 c0 6f bc ff ff 00 00 00 00 00 00 00 00 ....o...........
>>     backtrace:
>>       [<00000000490225c2>] slab_post_alloc_hook+0x80/0x2e0
>>       [<00000000dc142b33>] kmem_cache_alloc+0x166/0x2e0
>>       [<00000000168f1071>] acpi_os_acquire_object+0x2c/0x32
>>       [<00000000fcc615e1>] acpi_ps_alloc_op+0x4a/0x99
>>       [<00000000fb475bb4>] acpi_ps_get_next_arg+0x611/0x761
>>       [<000000009048d529>] acpi_ps_parse_loop+0x494/0x8d7
>>       [<000000005b0bf086>] acpi_ps_parse_aml+0x1bb/0x561
>>       [<000000007ab7e288>] acpi_ps_execute_method+0x20f/0x2d5
>>       [<00000000c12fa6b7>] acpi_ns_evaluate+0x34d/0x4f3
>>       [<000000001be94719>] acpi_evaluate_object+0x180/0x3ae
>>       [<00000000423a7ad5>] acpi_run_osc+0x128/0x250
>>       [<0000000040a72af8>] int3400_thermal_run_osc+0x6f/0xc0
>> [int3400_thermal]
>>       [<00000000f8d59987>] current_uuid_store+0xe3/0x120
>> [int3400_thermal]
>>       [<000000007e2e2d17>] dev_attr_store+0x14/0x30
>>       [<00000000b824b589>] sysfs_kf_write+0x38/0x50
>>       [<00000000beae69c1>] kernfs_fop_write_iter+0x146/0x1d0
>> root@marvin-IdeaPad-3-15ITL6:/home/marvin#
>>
>> The build process was as follows:
>>
>>    1573  10/24/2022 06:41:53 PM  cd linux_stable
>>    1574  10/24/2022 06:42:03 PM  git checkout v6.0.3
>>    1575  10/24/2022 06:42:44 PM  cd ..
>>    1576  10/24/2022 06:42:50 PM  time rm -rf linux_stable_build; time
>> cp
>> -rp linux_stable linux_stable_build; \
>>                       time diff -ur linux_stable linux_stable_build;
>> cd
>> linux_stable_build
>>    1577  10/24/2022 06:46:19 PM  git apply ../thermald-20221024-
>> 01.diff
>>    1578  10/24/2022 06:46:28 PM  vi ../config-5.15.0-50-memleak
>>    1579  10/24/2022 06:47:08 PM  cp ../config-5.15.0-50-memleak
>> .config
>>    1580  10/24/2022 06:47:16 PM  make olddefconfig
>>    1581  10/24/2022 06:48:42 PM  time nice make CC="ccache gcc"
>> KBUILD_BUILD_TIMESTAMP="" -j10 deb-pkg; date
>>
>> I think your patch definitively makes sense, but there's more to this
>> than meets the eye :-/
>>
>> Hope this helps.
>>
>> Thanks
>> Mirsad
>>
>> --
>> Mirsad Goran Todorovac
>> Sistem inženjer
>> Grafički fakultet | Akademija likovnih umjetnosti
>> Sveučilište u Zagrebu

--
Mirsad Goran Todorovac
Sistem inženjer
Grafički fakultet | Akademija likovnih umjetnosti
Sveučilište u Zagrebu
-- 
System engineer
Faculty of Graphic Arts | Academy of Fine Arts
University of Zagreb, Republic of Croatia
The European Union

Re: BUG: bisected: thermald regression (MEMLEAK) in commit c7ff29763989bd09c433f73fae3c1e1c15d9cda4

[Mirsad Goran Todorovac]

[-- Attachment #1: Type: text/plain, Size: 1077 bytes --]

Dear all,

On 24. 10. 2022. 20:56, Mirsad Goran Todorovac wrote:
> On 24. 10. 2022. 20:39, srinivas pandruvada wrote:
>
>>> Thank you for the patch. Unfortunately, when applied to v6.0.3 it
>>> didn't
>>> fix the issue.
>> Thanks for the test. I copied to acpi and acpica mailing list. Someone
>> can tell us what is this call doing wrong here. 

I have worse news: after every

# systemctl stop thermald
# systemctl start thermald

the number of leaks increases by one allocated block (apparently 80 
bytes). The effect appears to be
cummulative.

Please find the results of the MEMLEAK scan in the attachment.

In theory, motivated adversary could theoretically exhaust  i.e. 8 GiB 
in a loop of 10 million thermald stops/starts,
on my laptop and 2 sec for stop+start, it would be approx. 230 days.

Hope this helps.

Mirsad

-- 

Mirsad Goran Todorovac
Sistem inženjer
Grafički fakultet | Akademija likovnih umjetnosti
Sveučilište u Zagrebu
-- 
System engineer
Faculty of Graphic Arts | Academy of Fine Arts
University of Zagreb, Republic of Croatia
The European Union

[-- Attachment #2: memleak-cummulative.txt --]
[-- Type: text/plain, Size: 8584 bytes --]

unreferenced object 0xffff95e686df7c80 (size 80):
  comm "thermald", pid 853, jiffies 4294894308 (age 1327.784s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 0d 01 2d 00 00 00 00 00  ..........-.....
    af 07 01 40 fe a2 ff ff 00 00 00 00 00 00 00 00  ...@............
  backtrace:
    [<00000000da3c667c>] slab_post_alloc_hook+0x80/0x2e0
    [<000000007820f763>] kmem_cache_alloc+0x171/0x300
    [<00000000c8d00bcc>] acpi_os_acquire_object+0x2c/0x32
    [<000000003aec451a>] acpi_ps_alloc_op+0x4a/0x99
    [<000000008a7f6c81>] acpi_ps_get_next_arg+0x611/0x761
    [<00000000f7fcc03d>] acpi_ps_parse_loop+0x494/0x8d7
    [<0000000078ba6397>] acpi_ps_parse_aml+0x1bb/0x561
    [<00000000e189ac30>] acpi_ps_execute_method+0x20f/0x2d5
    [<0000000078532bb9>] acpi_ns_evaluate+0x34d/0x4f3
    [<0000000071538943>] acpi_evaluate_object+0x180/0x3ae
    [<00000000fdcec938>] acpi_run_osc+0x128/0x250
    [<00000000e0544e57>] int3400_thermal_run_osc+0x6f/0xc0 [int3400_thermal]
    [<000000007a443462>] current_uuid_store+0xe3/0x120 [int3400_thermal]
    [<000000005063ae55>] dev_attr_store+0x14/0x30
    [<000000001ccc0b04>] sysfs_kf_write+0x38/0x50
    [<00000000f24dcffc>] kernfs_fop_write_iter+0x146/0x1d0
unreferenced object 0xffff95e683768820 (size 80):
  comm "thermald", pid 853, jiffies 4294950021 (age 1105.064s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 0d 01 2d 00 00 00 00 00  ..........-.....
    3a 08 01 40 fe a2 ff ff 00 00 00 00 00 00 00 00  :..@............
  backtrace:
    [<00000000da3c667c>] slab_post_alloc_hook+0x80/0x2e0
    [<000000007820f763>] kmem_cache_alloc+0x171/0x300
    [<00000000c8d00bcc>] acpi_os_acquire_object+0x2c/0x32
    [<000000003aec451a>] acpi_ps_alloc_op+0x4a/0x99
    [<000000008a7f6c81>] acpi_ps_get_next_arg+0x611/0x761
    [<00000000f7fcc03d>] acpi_ps_parse_loop+0x494/0x8d7
    [<0000000078ba6397>] acpi_ps_parse_aml+0x1bb/0x561
    [<00000000e189ac30>] acpi_ps_execute_method+0x20f/0x2d5
    [<0000000078532bb9>] acpi_ns_evaluate+0x34d/0x4f3
    [<0000000071538943>] acpi_evaluate_object+0x180/0x3ae
    [<00000000fdcec938>] acpi_run_osc+0x128/0x250
    [<00000000e0544e57>] int3400_thermal_run_osc+0x6f/0xc0 [int3400_thermal]
    [<0000000014b96f7d>] int3400_thermal_change_mode+0xd3/0x110 [int3400_thermal]
    [<000000006ffc8826>] thermal_zone_device_set_mode+0x46/0xc0
    [<0000000036a1f221>] thermal_zone_device_disable+0x10/0x20
    [<00000000502e4e74>] mode_store+0x5c/0x80
unreferenced object 0xffff95e68a6181e0 (size 80):
  comm "thermald", pid 5206, jiffies 4294951963 (age 1097.300s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 0d 01 2d 00 00 00 00 00  ..........-.....
    af 07 01 40 fe a2 ff ff 00 00 00 00 00 00 00 00  ...@............
  backtrace:
    [<00000000da3c667c>] slab_post_alloc_hook+0x80/0x2e0
    [<000000007820f763>] kmem_cache_alloc+0x171/0x300
    [<00000000c8d00bcc>] acpi_os_acquire_object+0x2c/0x32
    [<000000003aec451a>] acpi_ps_alloc_op+0x4a/0x99
    [<000000008a7f6c81>] acpi_ps_get_next_arg+0x611/0x761
    [<00000000f7fcc03d>] acpi_ps_parse_loop+0x494/0x8d7
    [<0000000078ba6397>] acpi_ps_parse_aml+0x1bb/0x561
    [<00000000e189ac30>] acpi_ps_execute_method+0x20f/0x2d5
    [<0000000078532bb9>] acpi_ns_evaluate+0x34d/0x4f3
    [<0000000071538943>] acpi_evaluate_object+0x180/0x3ae
    [<00000000fdcec938>] acpi_run_osc+0x128/0x250
    [<00000000e0544e57>] int3400_thermal_run_osc+0x6f/0xc0 [int3400_thermal]
    [<000000007a443462>] current_uuid_store+0xe3/0x120 [int3400_thermal]
    [<000000005063ae55>] dev_attr_store+0x14/0x30
    [<000000001ccc0b04>] sysfs_kf_write+0x38/0x50
    [<00000000f24dcffc>] kernfs_fop_write_iter+0x146/0x1d0
unreferenced object 0xffff95e687dbe500 (size 80):
  comm "thermald", pid 5206, jiffies 4294952889 (age 1093.724s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 0d 01 2d 00 00 00 00 00  ..........-.....
    3a 08 01 40 fe a2 ff ff 00 00 00 00 00 00 00 00  :..@............
  backtrace:
    [<00000000da3c667c>] slab_post_alloc_hook+0x80/0x2e0
    [<000000007820f763>] kmem_cache_alloc+0x171/0x300
    [<00000000c8d00bcc>] acpi_os_acquire_object+0x2c/0x32
    [<000000003aec451a>] acpi_ps_alloc_op+0x4a/0x99
    [<000000008a7f6c81>] acpi_ps_get_next_arg+0x611/0x761
    [<00000000f7fcc03d>] acpi_ps_parse_loop+0x494/0x8d7
    [<0000000078ba6397>] acpi_ps_parse_aml+0x1bb/0x561
    [<00000000e189ac30>] acpi_ps_execute_method+0x20f/0x2d5
    [<0000000078532bb9>] acpi_ns_evaluate+0x34d/0x4f3
    [<0000000071538943>] acpi_evaluate_object+0x180/0x3ae
    [<00000000fdcec938>] acpi_run_osc+0x128/0x250
    [<00000000e0544e57>] int3400_thermal_run_osc+0x6f/0xc0 [int3400_thermal]
    [<0000000014b96f7d>] int3400_thermal_change_mode+0xd3/0x110 [int3400_thermal]
    [<000000006ffc8826>] thermal_zone_device_set_mode+0x46/0xc0
    [<0000000036a1f221>] thermal_zone_device_disable+0x10/0x20
    [<00000000502e4e74>] mode_store+0x5c/0x80
unreferenced object 0xffff95e687a34cd0 (size 80):
  comm "thermald", pid 5214, jiffies 4294953628 (age 1090.768s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 0d 01 2d 00 00 00 00 00  ..........-.....
    af 07 01 40 fe a2 ff ff 00 00 00 00 00 00 00 00  ...@............
  backtrace:
    [<00000000da3c667c>] slab_post_alloc_hook+0x80/0x2e0
    [<000000007820f763>] kmem_cache_alloc+0x171/0x300
    [<00000000c8d00bcc>] acpi_os_acquire_object+0x2c/0x32
    [<000000003aec451a>] acpi_ps_alloc_op+0x4a/0x99
    [<000000008a7f6c81>] acpi_ps_get_next_arg+0x611/0x761
    [<00000000f7fcc03d>] acpi_ps_parse_loop+0x494/0x8d7
    [<0000000078ba6397>] acpi_ps_parse_aml+0x1bb/0x561
    [<00000000e189ac30>] acpi_ps_execute_method+0x20f/0x2d5
    [<0000000078532bb9>] acpi_ns_evaluate+0x34d/0x4f3
    [<0000000071538943>] acpi_evaluate_object+0x180/0x3ae
    [<00000000fdcec938>] acpi_run_osc+0x128/0x250
    [<00000000e0544e57>] int3400_thermal_run_osc+0x6f/0xc0 [int3400_thermal]
    [<000000007a443462>] current_uuid_store+0xe3/0x120 [int3400_thermal]
    [<000000005063ae55>] dev_attr_store+0x14/0x30
    [<000000001ccc0b04>] sysfs_kf_write+0x38/0x50
    [<00000000f24dcffc>] kernfs_fop_write_iter+0x146/0x1d0
unreferenced object 0xffff95e687a34820 (size 80):
  comm "thermald", pid 5214, jiffies 4295194182 (age 128.568s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 0d 01 2d 00 00 00 00 00  ..........-.....
    3a 08 01 40 fe a2 ff ff 00 00 00 00 00 00 00 00  :..@............
  backtrace:
    [<00000000da3c667c>] slab_post_alloc_hook+0x80/0x2e0
    [<000000007820f763>] kmem_cache_alloc+0x171/0x300
    [<00000000c8d00bcc>] acpi_os_acquire_object+0x2c/0x32
    [<000000003aec451a>] acpi_ps_alloc_op+0x4a/0x99
    [<000000008a7f6c81>] acpi_ps_get_next_arg+0x611/0x761
    [<00000000f7fcc03d>] acpi_ps_parse_loop+0x494/0x8d7
    [<0000000078ba6397>] acpi_ps_parse_aml+0x1bb/0x561
    [<00000000e189ac30>] acpi_ps_execute_method+0x20f/0x2d5
    [<0000000078532bb9>] acpi_ns_evaluate+0x34d/0x4f3
    [<0000000071538943>] acpi_evaluate_object+0x180/0x3ae
    [<00000000fdcec938>] acpi_run_osc+0x128/0x250
    [<00000000e0544e57>] int3400_thermal_run_osc+0x6f/0xc0 [int3400_thermal]
    [<0000000014b96f7d>] int3400_thermal_change_mode+0xd3/0x110 [int3400_thermal]
    [<000000006ffc8826>] thermal_zone_device_set_mode+0x46/0xc0
    [<0000000036a1f221>] thermal_zone_device_disable+0x10/0x20
    [<00000000502e4e74>] mode_store+0x5c/0x80
unreferenced object 0xffff95e687dbe4b0 (size 80):
  comm "thermald", pid 5763, jiffies 4295197814 (age 114.188s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 0d 01 2d 00 00 00 00 00  ..........-.....
    af 07 01 40 fe a2 ff ff 00 00 00 00 00 00 00 00  ...@............
  backtrace:
    [<00000000da3c667c>] slab_post_alloc_hook+0x80/0x2e0
    [<000000007820f763>] kmem_cache_alloc+0x171/0x300
    [<00000000c8d00bcc>] acpi_os_acquire_object+0x2c/0x32
    [<000000003aec451a>] acpi_ps_alloc_op+0x4a/0x99
    [<000000008a7f6c81>] acpi_ps_get_next_arg+0x611/0x761
    [<00000000f7fcc03d>] acpi_ps_parse_loop+0x494/0x8d7
    [<0000000078ba6397>] acpi_ps_parse_aml+0x1bb/0x561
    [<00000000e189ac30>] acpi_ps_execute_method+0x20f/0x2d5
    [<0000000078532bb9>] acpi_ns_evaluate+0x34d/0x4f3
    [<0000000071538943>] acpi_evaluate_object+0x180/0x3ae
    [<00000000fdcec938>] acpi_run_osc+0x128/0x250
    [<00000000e0544e57>] int3400_thermal_run_osc+0x6f/0xc0 [int3400_thermal]
    [<000000007a443462>] current_uuid_store+0xe3/0x120 [int3400_thermal]
    [<000000005063ae55>] dev_attr_store+0x14/0x30
    [<000000001ccc0b04>] sysfs_kf_write+0x38/0x50
    [<00000000f24dcffc>] kernfs_fop_write_iter+0x146/0x1d0

Re: BUG: bisected: thermald regression (MEMLEAK) in commit c7ff29763989bd09c433f73fae3c1e1c15d9cda4

[srinivas pandruvada]

On Wed, 2022-10-26 at 19:52 +0200, Mirsad Goran Todorovac wrote:
> Dear all,
> 
> On 24. 10. 2022. 20:56, Mirsad Goran Todorovac wrote:
> > On 24. 10. 2022. 20:39, srinivas pandruvada wrote:
> > 
> > > > Thank you for the patch. Unfortunately, when applied to v6.0.3
> > > > it
> > > > didn't
> > > > fix the issue.
> > > Thanks for the test. I copied to acpi and acpica mailing list.
> > > Someone
> > > can tell us what is this call doing wrong here. 
> 
> I have worse news: after every
> 
> # systemctl stop thermald
> # systemctl start thermald
> 
> the number of leaks increases by one allocated block (apparently 80 
> bytes). The effect appears to be
> cummulative.
> 
> Please find the results of the MEMLEAK scan in the attachment.
> 
> In theory, motivated adversary could theoretically exhaust  i.e. 8
> GiB 
> in a loop of 10 million thermald stops/starts,
Of course it needs to be debugged. To start/stop systemctl service you
need root access. If you have root access, there are other worse things
can be done.

Thanks,
Srinivas

> on my laptop and 2 sec for stop+start, it would be approx. 230 days.
> 
> Hope this helps.
> 
> Mirsad
> 
> -- 
> 
> Mirsad Goran Todorovac
> Sistem inženjer
> Grafički fakultet | Akademija likovnih umjetnosti
> Sveučilište u Zagrebu

Re: BUG: bisected: thermald regression (MEMLEAK) in commit c7ff29763989bd09c433f73fae3c1e1c15d9cda4

[Mirsad Goran Todorovac]

[-- Attachment #1: Type: text/plain, Size: 2021 bytes --]

Re-sending compressed attachments to fit into the size limit.

On 27. 10. 2022. 20:03, Mirsad Goran Todorovac wrote:
> P.S.
>
> Forgot another useful thing you've mentioned: please find attached the 
> dmesg output.
>
> Good luck!
>
> Mirsad
>
> On 27. 10. 2022. 00:48, srinivas pandruvada wrote:
>> On Wed, 2022-10-26 at 19:52 +0200, Mirsad Goran Todorovac wrote:
>>> Dear all,
>>>
>>> On 24. 10. 2022. 20:56, Mirsad Goran Todorovac wrote:
>>>> On 24. 10. 2022. 20:39, srinivas pandruvada wrote:
>>>>
>>>>>> Thank you for the patch. Unfortunately, when applied to v6.0.3
>>>>>> it
>>>>>> didn't
>>>>>> fix the issue.
>>>>> Thanks for the test. I copied to acpi and acpica mailing list.
>>>>> Someone
>>>>> can tell us what is this call doing wrong here.
>>> I have worse news: after every
>>>
>>> # systemctl stop thermald
>>> # systemctl start thermald
>>>
>>> the number of leaks increases by one allocated block (apparently 80
>>> bytes). The effect appears to be
>>> cummulative.
>>>
>>> Please find the results of the MEMLEAK scan in the attachment.
>>>
>>> In theory, motivated adversary could theoretically exhaust i.e. 8
>>> GiB
>>> in a loop of 10 million thermald stops/starts,
>> Of course it needs to be debugged. To start/stop systemctl service you
>> need root access. If you have root access, there are other worse things
>> can be done.
>>
>> Thanks,
>> Srinivas
>>
>>> on my laptop and 2 sec for stop+start, it would be approx. 230 days.
>>>
>>> Hope this helps.
>>>
>>> Mirsad
>>>
>>> -- 
>>>
>>> Mirsad Goran Todorovac
>>> Sistem inženjer
>>> Grafički fakultet | Akademija likovnih umjetnosti
>>> Sveučilište u Zagrebu
>
> -- 
> Mirsad Goran Todorovac
> Sistem inženjer
> Grafički fakultet | Akademija likovnih umjetnosti
> Sveučilište u Zagrebu

--
Mirsad Goran Todorovac
Sistem inženjer
Grafički fakultet | Akademija likovnih umjetnosti
Sveučilište u Zagrebu
-- 
System engineer
Faculty of Graphic Arts | Academy of Fine Arts
University of Zagreb, Republic of Croatia
The European Union

[-- Attachment #2: thermald-memleak.lshw.txt.gz --]
[-- Type: application/gzip, Size: 5897 bytes --]

[-- Attachment #3: thermald-memleak.wsleep1.txt.gz --]
[-- Type: application/gzip, Size: 5486 bytes --]

[-- Attachment #4: thermald_memleak_dmesg.txt.gz --]
[-- Type: application/gzip, Size: 39021 bytes --]

Re: BUG: bisected: thermald regression (MEMLEAK) in commit c7ff29763989bd09c433f73fae3c1e1c15d9cda4

[Rafael J. Wysocki]

On Thu, Oct 27, 2022 at 8:20 PM Mirsad Goran Todorovac
<mirsad.todorovac@alu.unizg.hr> wrote:
>
> Re-sending compressed attachments to fit into the size limit.
>
> On 27. 10. 2022. 20:03, Mirsad Goran Todorovac wrote:
> > P.S.
> >
> > Forgot another useful thing you've mentioned: please find attached the
> > dmesg output.
> >
> > Good luck!

I'm wondering if the problem is reproducible with this patch applied:

https://patchwork.kernel.org/project/linux-acpi/patch/20221019073443.248215-1-chenzhongjin@huawei.com/

Re: BUG: bisected: thermald regression (MEMLEAK) in commit c7ff29763989bd09c433f73fae3c1e1c15d9cda4

[Thorsten Leemhuis]

On 28.10.22 20:25, Rafael J. Wysocki wrote:
> On Thu, Oct 27, 2022 at 8:20 PM Mirsad Goran Todorovac
> <mirsad.todorovac@alu.unizg.hr> wrote:
>>
>> Re-sending compressed attachments to fit into the size limit.
>>
>> On 27. 10. 2022. 20:03, Mirsad Goran Todorovac wrote:
>>> P.S.
>>>
>>> Forgot another useful thing you've mentioned: please find attached the
>>> dmesg output.
>>>
>>> Good luck!
> 
> I'm wondering if the problem is reproducible with this patch applied:
> 
> https://patchwork.kernel.org/project/linux-acpi/patch/20221019073443.248215-1-chenzhongjin@huawei.com/

Mirsad, did you ever give that a try?

Side note: while looking into this, I noticed that Rafael proposed and
merged a different fix:
https://lore.kernel.org/all/2669303.mvXUDI8C0e@kreacher/
https://patchwork.kernel.org/project/linux-acpi/patch/2669303.mvXUDI8C0e@kreacher/

Ciao, Thorsten

Re: BUG: bisected: thermald regression (MEMLEAK) in commit c7ff29763989bd09c433f73fae3c1e1c15d9cda4

[Mirsad Goran Todorovac]

On 15.11.2022. 11:36, Thorsten Leemhuis wrote:
> 
> 
> On 28.10.22 20:25, Rafael J. Wysocki wrote:
>> On Thu, Oct 27, 2022 at 8:20 PM Mirsad Goran Todorovac
>> <mirsad.todorovac@alu.unizg.hr> wrote:
>>>
>>> Re-sending compressed attachments to fit into the size limit.
>>>
>>> On 27. 10. 2022. 20:03, Mirsad Goran Todorovac wrote:
>>>> P.S.
>>>>
>>>> Forgot another useful thing you've mentioned: please find attached the
>>>> dmesg output.
>>>>
>>>> Good luck!
>>
>> I'm wondering if the problem is reproducible with this patch applied:
>>
>> https://patchwork.kernel.org/project/linux-acpi/patch/20221019073443.248215-1-chenzhongjin@huawei.com/
> 
> Mirsad, did you ever give that a try?
> 
> Side note: while looking into this, I noticed that Rafael proposed and
> merged a different fix:
> https://lore.kernel.org/all/2669303.mvXUDI8C0e@kreacher/
> https://patchwork.kernel.org/project/linux-acpi/patch/2669303.mvXUDI8C0e@kreacher/
> 
> Ciao, Thorsten

Hi, Thorsten,

Yes, I gave it considerable effort, however four of my kernels {4.14, 
4.9, 4.4 and 4.0} did not boot at all, now I have the problem that the 
menu config doesn't respect CONFIG_DEBUG_KMEMLEAK=y.

I am serious about this and I had some 80 builds in the last month.
Right now I have problems with my day job. :-/

Hope to catch up with you soon.

Cheers,
Mirsad

-- 
Mirsad Todorovac
System engineer
Faculty of Graphic Arts | Academy of Fine Arts
University of Zagreb
Republic of Croatia, the European Union
--
Sistem inženjer
Grafički fakultet | Akademija likovnih umjetnosti
Sveučilište u Zagrebu

Re: BUG: bisected: thermald regression (MEMLEAK) in commit c7ff29763989bd09c433f73fae3c1e1c15d9cda4

[Mirsad Goran Todorovac]

On 28.10.2022. 20:25, Rafael J. Wysocki wrote:
> On Thu, Oct 27, 2022 at 8:20 PM Mirsad Goran Todorovac
> <mirsad.todorovac@alu.unizg.hr> wrote:
>>
>> Re-sending compressed attachments to fit into the size limit.
>>
>> On 27. 10. 2022. 20:03, Mirsad Goran Todorovac wrote:
>>> P.S.
>>>
>>> Forgot another useful thing you've mentioned: please find attached the
>>> dmesg output.
>>>
>>> Good luck!
> 
> I'm wondering if the problem is reproducible with this patch applied:
> 
> https://patchwork.kernel.org/project/linux-acpi/patch/20221019073443.248215-1-chenzhongjin@huawei.com/

Dear Rafael,

Thousand apologies. Your email was still bold in my Thunderbird, which 
means that I failed to notice it and open it.

The patch applied successfully to commit c7ff29763989 and it is 
currently building and still has to undergo torture tests.

Cheers,
Mirsad

-- 
Mirsad Todorovac
System engineer
Faculty of Graphic Arts | Academy of Fine Arts
University of Zagreb
Republic of Croatia, the European Union
--
Sistem inženjer
Grafički fakultet | Akademija likovnih umjetnosti
Sveučilište u Zagrebu

Re: BUG: bisected: thermald regression (MEMLEAK) in commit c7ff29763989bd09c433f73fae3c1e1c15d9cda4

[Rafael J. Wysocki]

On Tue, Nov 15, 2022 at 3:40 PM Mirsad Goran Todorovac
<mirsad.todorovac@alu.unizg.hr> wrote:
>
> On 28.10.2022. 20:25, Rafael J. Wysocki wrote:
> > On Thu, Oct 27, 2022 at 8:20 PM Mirsad Goran Todorovac
> > <mirsad.todorovac@alu.unizg.hr> wrote:
> >>
> >> Re-sending compressed attachments to fit into the size limit.
> >>
> >> On 27. 10. 2022. 20:03, Mirsad Goran Todorovac wrote:
> >>> P.S.
> >>>
> >>> Forgot another useful thing you've mentioned: please find attached the
> >>> dmesg output.
> >>>
> >>> Good luck!
> >
> > I'm wondering if the problem is reproducible with this patch applied:
> >
> > https://patchwork.kernel.org/project/linux-acpi/patch/20221019073443.248215-1-chenzhongjin@huawei.com/
>
> Dear Rafael,
>
> Thousand apologies. Your email was still bold in my Thunderbird, which
> means that I failed to notice it and open it.
>
> The patch applied successfully to commit c7ff29763989 and it is
> currently building and still has to undergo torture tests.

Actually, that fix was problematic too.

I would recommend testing with this one applied instead:

https://patchwork.kernel.org/project/linux-acpi/patch/2669303.mvXUDI8C0e@kreacher/

Re: BUG: bisected: thermald regression (MEMLEAK) in commit c7ff29763989bd09c433f73fae3c1e1c15d9cda4

[Mirsad Goran Todorovac]

[-- Attachment #1: Type: text/plain, Size: 3422 bytes --]

On 15.11.2022. 15:49, Rafael J. Wysocki wrote:
> On Tue, Nov 15, 2022 at 3:40 PM Mirsad Goran Todorovac
> <mirsad.todorovac@alu.unizg.hr> wrote:
>>
>> On 28.10.2022. 20:25, Rafael J. Wysocki wrote:
>>> On Thu, Oct 27, 2022 at 8:20 PM Mirsad Goran Todorovac
>>> <mirsad.todorovac@alu.unizg.hr> wrote:
>>>>
>>>> Re-sending compressed attachments to fit into the size limit.
>>>>
>>>> On 27. 10. 2022. 20:03, Mirsad Goran Todorovac wrote:
>>>>> P.S.
>>>>>
>>>>> Forgot another useful thing you've mentioned: please find attached the
>>>>> dmesg output.
>>>>>
>>>>> Good luck!
>>>
>>> I'm wondering if the problem is reproducible with this patch applied:
>>>
>>> https://patchwork.kernel.org/project/linux-acpi/patch/20221019073443.248215-1-chenzhongjin@huawei.com/
>>
>> Dear Rafael,
>>
>> Thousand apologies. Your email was still bold in my Thunderbird, which
>> means that I failed to notice it and open it.
>>
>> The patch applied successfully to commit c7ff29763989 and it is
>> currently building and still has to undergo torture tests.
> 
> Actually, that fix was problematic too.
> 
> I would recommend testing with this one applied instead:
> 
> https://patchwork.kernel.org/project/linux-acpi/patch/2669303.mvXUDI8C0e@kreacher/

Hi Rafael,

I have applied this patch, as it is evident from the git diff command:

mtodorov@domac:~/linux/kernel/linux_stable_build$ git diff 
c7ff29763989bd09c433f73fae3c1e1c15d9cda4
diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
index 8e011e59b9b4..ee1832ba39a2 100644
--- a/drivers/acpi/acpica/dsmethod.c
+++ b/drivers/acpi/acpica/dsmethod.c
@@ -517,7 +517,7 @@ acpi_ds_call_control_method(struct acpi_thread_state 
*thread,
         info = ACPI_ALLOCATE_ZEROED(sizeof(struct acpi_evaluate_info));
         if (!info) {
                 status = AE_NO_MEMORY;
-               goto cleanup;
+               goto pop_walk_state;
         }

         info->parameters = &this_walk_state->operands[0];
@@ -529,7 +529,7 @@ acpi_ds_call_control_method(struct acpi_thread_state 
*thread,

         ACPI_FREE(info);
         if (ACPI_FAILURE(status)) {
-               goto cleanup;
+               goto pop_walk_state;
         }

         next_walk_state->method_nesting_depth =
@@ -575,6 +575,12 @@ acpi_ds_call_control_method(struct 
acpi_thread_state *thread,

         return_ACPI_STATUS(status);

+pop_walk_state:
+
+       /* On error, pop the walk state to be deleted from thread */
+
+       acpi_ds_pop_walk_state(thread);
+
  cleanup:

         /* On error, we must terminate the method properly */

However, after a couple of hundred executions of:

   for a in {0..2000}; do
	echo $a
	systemctl stop thermald
	sleep 1
	systemctl start thermald
	sleep 1
   done

it first starts with a single leak, until the number of restarts is
greater than 500. Currently the number of unreferenced objects is 93.

Please find the log and config attached.

The script that reproduced the bug was also run simultaneously:

for a in {0..2000}; do echo -n $a': '; \
	grep thermald /sys/kernel/debug/kmemleak | wc -l; \
	cat /sys/kernel/debug/kmemleak > /dev/null; \
	tail -40 /sys/kernel/debug/kmemleak > /dev/null; \
done


-- 
Mirsad Todorovac
System engineer
Faculty of Graphic Arts | Academy of Fine Arts
University of Zagreb
Republic of Croatia, the European Union
--
Sistem inženjer
Grafički fakultet | Akademija likovnih umjetnosti
Sveučilište u Zagrebu

[-- Attachment #2: thermald-kmemleak-20221115.log.gz --]
[-- Type: application/gzip, Size: 2943 bytes --]

[-- Attachment #3: thermald-leak-fix-wysocki.config.gz --]
[-- Type: application/gzip, Size: 63795 bytes --]