[PATCH 1/3] mm/slub: fixing backtrace of objects because of redzone adjustment

[PATCH 1/3] mm/slub: fixing backtrace of objects because of redzone adjustment

[Maninder Singh]

fixing commit 8e7f37f2aaa5 ("mm: Add mem_dump_obj() to print source
of memory block")

with current code, Backtrace of allocated object is coming wrong:
/ # cat /proc/meminfo
[   14.969843]  slab kmalloc-64 start c8ab0140 data offset 64 pointer offset 0 size 64 allocated at 0x6b6b6b6b
[   14.970635]     0x6b6b6b6b
[   14.970794]     0x6b6b6b6b
[   14.970932]     0x6b6b6b6b
[   14.971077]     0x6b6b6b6b
[   14.971202]     0x6b6b6b6b
[   14.971317]     0x6b6b6b6b
[   14.971423]     0x6b6b6b6b
[   14.971635]     0x6b6b6b6b
[   14.971740]     0x6b6b6b6b
[   14.971871]     0x6b6b6b6b
[   14.972229]     0x6b6b6b6b
[   14.972363]     0x6b6b6b6b
[   14.972505]     0xa56b6b6b
[   14.972631]     0xbbbbbbbb
[   14.972734]     0xc8ab0400
[   14.972891]     meminfo_proc_show+0x40/0x4fc

And reason is red zone was not adjusted from object address.
after adding fixup for redzone, backtrace is coming correct:
/ # cat /proc/meminfo
[   14.870782]  slab kmalloc-64 start c8ab0140 data offset 64 pointer offset 128 size 64 allocated at meminfo_proc_show+0x40/0x4f4
[   14.871817]     meminfo_proc_show+0x40/0x4f4
[   14.872035]     seq_read_iter+0x18c/0x4c4
[   14.872229]     proc_reg_read_iter+0x84/0xac
[   14.872433]     generic_file_splice_read+0xe8/0x17c
[   14.872621]     splice_direct_to_actor+0xb8/0x290
[   14.872747]     do_splice_direct+0xa0/0xe0
[   14.872896]     do_sendfile+0x2d0/0x438
[   14.873044]     sys_sendfile64+0x12c/0x140
[   14.873229]     ret_fast_syscall+0x0/0x58
[   14.873372]     0xbe861de4

Signed-off-by: Vaneet Narang <v.narang@samsung.com>
Signed-off-by: Maninder Singh <maninder1.s@samsung.com>
---
 mm/slub.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mm/slub.c b/mm/slub.c
index 1912c4614248..9d13f0117ae6 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -4052,6 +4052,7 @@ void kmem_obj_info(struct kmem_obj_info *kpp, void *object, struct page *page)
 	    !(s->flags & SLAB_STORE_USER))
 		return;
 #ifdef CONFIG_SLUB_DEBUG
+	objp = fixup_red_left(s, objp);
 	trackp = get_track(s, objp, TRACK_ALLOC);
 	kpp->kp_ret = (void *)trackp->addr;
 #ifdef CONFIG_STACKTRACE
-- 
2.17.1

[PATCH 2/3] mm/slub: Add Support for free path information of an object.

[Maninder Singh]

Adding support for inforamtion of free path along with allocation
path of an object:

slab kmalloc-64 start c8ab0140 data offset 64 pointer offset 0 size 64 allocated at meminfo_proc_show+0x40/0x4fc
[   20.192078]     meminfo_proc_show+0x40/0x4fc
[   20.192263]     seq_read_iter+0x18c/0x4c4
[   20.192430]     proc_reg_read_iter+0x84/0xac
[   20.192617]     generic_file_splice_read+0xe8/0x17c
[   20.192816]     splice_direct_to_actor+0xb8/0x290
[   20.193008]     do_splice_direct+0xa0/0xe0
[   20.193185]     do_sendfile+0x2d0/0x438
[   20.193345]     sys_sendfile64+0x12c/0x140
[   20.193523]     ret_fast_syscall+0x0/0x58
[   20.193695]     0xbeeacde4
[   20.193822]  Free path:
[   20.193935]     meminfo_proc_show+0x5c/0x4fc
[   20.194115]     seq_read_iter+0x18c/0x4c4
[   20.194285]     proc_reg_read_iter+0x84/0xac
[   20.194475]     generic_file_splice_read+0xe8/0x17c
[   20.194685]     splice_direct_to_actor+0xb8/0x290
[   20.194870]     do_splice_direct+0xa0/0xe0
[   20.195014]     do_sendfile+0x2d0/0x438
[   20.195174]     sys_sendfile64+0x12c/0x140
[   20.195336]     ret_fast_syscall+0x0/0x58
[   20.195491]     0xbeeacde4

Co-developed-by: Vaneet Narang <v.narang@samsung.com>
Signed-off-by: Vaneet Narang <v.narang@samsung.com>
Signed-off-by: Maninder Singh <maninder1.s@samsung.com>
---
 mm/slab.h        |  1 +
 mm/slab_common.c | 12 +++++++++++-
 mm/slub.c        |  7 +++++++
 mm/util.c        |  2 +-
 4 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/mm/slab.h b/mm/slab.h
index c96bca9825d9..e360e3326232 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -644,6 +644,7 @@ struct kmem_obj_info {
 	struct kmem_cache *kp_slab_cache;
 	void *kp_ret;
 	void *kp_stack[KS_ADDRS_COUNT];
+	void *kp_free_stack[KS_ADDRS_COUNT];
 };
 void kmem_obj_info(struct kmem_obj_info *kpp, void *object, struct page *page);
 #endif
diff --git a/mm/slab_common.c b/mm/slab_common.c
index 4c6107e39f9a..42288db97a52 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -556,7 +556,7 @@ EXPORT_SYMBOL_GPL(kmem_valid_obj);
  * depends on the type of object and on how much debugging is enabled.
  * For a slab-cache object, the fact that it is a slab object is printed,
  * and, if available, the slab name, return address, and stack trace from
- * the allocation of that object.
+ * the allocation and last free path of that object.
  *
  * This function will splat if passed a pointer to a non-slab object.
  * If you are not sure what type of object you have, you should instead
@@ -601,6 +601,16 @@ void kmem_dump_obj(void *object)
 			break;
 		pr_info("    %pS\n", kp.kp_stack[i]);
 	}
+
+	if (kp.kp_free_stack[0])
+		pr_cont(" Free path:\n");
+
+	for (i = 0; i < ARRAY_SIZE(kp.kp_free_stack); i++) {
+		if (!kp.kp_free_stack[i])
+			break;
+		pr_info("    %pS\n", kp.kp_free_stack[i]);
+	}
+
 }
 EXPORT_SYMBOL_GPL(kmem_dump_obj);
 #endif
diff --git a/mm/slub.c b/mm/slub.c
index 9d13f0117ae6..a0cb90487b1a 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -4061,6 +4061,13 @@ void kmem_obj_info(struct kmem_obj_info *kpp, void *object, struct page *page)
 		if (!kpp->kp_stack[i])
 			break;
 	}
+
+	trackp = get_track(s, objp, TRACK_FREE);
+	for (i = 0; i < KS_ADDRS_COUNT && i < TRACK_ADDRS_COUNT; i++) {
+		kpp->kp_free_stack[i] = (void *)trackp->addrs[i];
+		if (!kpp->kp_free_stack[i])
+			break;
+	}
 #endif
 #endif
 }
diff --git a/mm/util.c b/mm/util.c
index 143c627fb3e8..9d69ca30514a 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -993,7 +993,7 @@ int __weak memcmp_pages(struct page *page1, struct page *page2)
  * depends on the type of object and on how much debugging is enabled.
  * For example, for a slab-cache object, the slab name is printed, and,
  * if available, the return address and stack trace from the allocation
- * of that object.
+ * and last free path of that object.
  */
 void mem_dump_obj(void *object)
 {
-- 
2.17.1

[PATCH 3/3] arm: print alloc free paths for address in registers

[Maninder Singh]

In case of user after free kernel OOPs, free path of object
is required to debug futher.
And in most of cases object address is present in one of registers.

Thus check for register address and if it belongs to slab,
print its alloc and free path.

e.g. in below issue  register r6 belongs to slab, and user afree issue
occurred on one of its derefer values:

[   20.182197] Unable to handle kernel paging request at virtual address 6b6b6b6f
....
[   20.185035] pc : [<c0538afc>]    lr : [<c0465674>]    psr: 60000013
[   20.185271] sp : c8927d40  ip : ffffefff  fp : c8aa8020
[   20.185462] r10: c8927e10  r9 : 00000001  r8 : 00400cc0
[   20.185674] r7 : 00000000  r6 : c8ab0180  r5 : c1804a80  r4 : c8aa8008
[   20.185924] r3 : c1a5661c  r2 : 00000000  r1 : 6b6b6b6b  r0 : c139bf48
.....
[   20.191499] Register r6 information: slab kmalloc-64 start c8ab0140 data offset 64 pointer offset 0 size 64 allocated at meminfo_proc_show+0x40/0x4fc
[   20.192078]     meminfo_proc_show+0x40/0x4fc
[   20.192263]     seq_read_iter+0x18c/0x4c4
[   20.192430]     proc_reg_read_iter+0x84/0xac
[   20.192617]     generic_file_splice_read+0xe8/0x17c
[   20.192816]     splice_direct_to_actor+0xb8/0x290
[   20.193008]     do_splice_direct+0xa0/0xe0
[   20.193185]     do_sendfile+0x2d0/0x438
[   20.193345]     sys_sendfile64+0x12c/0x140
[   20.193523]     ret_fast_syscall+0x0/0x58
[   20.193695]     0xbeeacde4
[   20.193822]  Free path:
[   20.193935]     meminfo_proc_show+0x5c/0x4fc
[   20.194115]     seq_read_iter+0x18c/0x4c4
[   20.194285]     proc_reg_read_iter+0x84/0xac
[   20.194475]     generic_file_splice_read+0xe8/0x17c
[   20.194685]     splice_direct_to_actor+0xb8/0x290
[   20.194870]     do_splice_direct+0xa0/0xe0
[   20.195014]     do_sendfile+0x2d0/0x438
[   20.195174]     sys_sendfile64+0x12c/0x140
[   20.195336]     ret_fast_syscall+0x0/0x58
[   20.195491]     0xbeeacde4

Co-developed-by: Vaneet Narang <v.narang@samsung.com>
Signed-off-by: Vaneet Narang <v.narang@samsung.com>
Signed-off-by: Maninder Singh <maninder1.s@samsung.com>
---
 arch/arm/include/asm/bug.h |  1 +
 arch/arm/kernel/process.c  | 11 +++++++++++
 arch/arm/kernel/traps.c    |  1 +
 3 files changed, 13 insertions(+)

diff --git a/arch/arm/include/asm/bug.h b/arch/arm/include/asm/bug.h
index 673c7dd75ab9..ba8d9d7d242b 100644
--- a/arch/arm/include/asm/bug.h
+++ b/arch/arm/include/asm/bug.h
@@ -88,5 +88,6 @@ extern asmlinkage void c_backtrace(unsigned long fp, int pmode,
 struct mm_struct;
 void show_pte(const char *lvl, struct mm_struct *mm, unsigned long addr);
 extern void __show_regs(struct pt_regs *);
+extern void __show_regs_alloc_free(struct pt_regs *regs);
 
 #endif
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 5199a2bb4111..249dd285c4d8 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -92,6 +92,17 @@ void arch_cpu_idle_exit(void)
 	ledtrig_cpu(CPU_LED_IDLE_END);
 }
 
+void __show_regs_alloc_free(struct pt_regs *regs)
+{
+	int i;
+
+	/* check for r0 - r12 only */
+	for (i = 0; i < 13; i++) {
+		pr_alert("Register r%d information:", i);
+		mem_dump_obj((void *)regs->uregs[i]);
+	}
+}
+
 void __show_regs(struct pt_regs *regs)
 {
 	unsigned long flags;
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index 17d5a785df28..64308e3a5d0c 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -287,6 +287,7 @@ static int __die(const char *str, int err, struct pt_regs *regs)
 
 	print_modules();
 	__show_regs(regs);
+	__show_regs_alloc_free(regs);
 	pr_emerg("Process %.*s (pid: %d, stack limit = 0x%p)\n",
 		 TASK_COMM_LEN, tsk->comm, task_pid_nr(tsk), end_of_stack(tsk));
 
-- 
2.17.1

Re: [PATCH 1/3] mm/slub: fixing backtrace of objects because of redzone adjustment

[Paul E. McKenney]

On Tue, Mar 16, 2021 at 04:07:10PM +0530, Maninder Singh wrote:
> fixing commit 8e7f37f2aaa5 ("mm: Add mem_dump_obj() to print source
> of memory block")
> 
> with current code, Backtrace of allocated object is coming wrong:
> / # cat /proc/meminfo
> [   14.969843]  slab kmalloc-64 start c8ab0140 data offset 64 pointer offset 0 size 64 allocated at 0x6b6b6b6b
> [   14.970635]     0x6b6b6b6b
> [   14.970794]     0x6b6b6b6b
> [   14.970932]     0x6b6b6b6b
> [   14.971077]     0x6b6b6b6b
> [   14.971202]     0x6b6b6b6b
> [   14.971317]     0x6b6b6b6b
> [   14.971423]     0x6b6b6b6b
> [   14.971635]     0x6b6b6b6b
> [   14.971740]     0x6b6b6b6b
> [   14.971871]     0x6b6b6b6b
> [   14.972229]     0x6b6b6b6b
> [   14.972363]     0x6b6b6b6b
> [   14.972505]     0xa56b6b6b
> [   14.972631]     0xbbbbbbbb
> [   14.972734]     0xc8ab0400
> [   14.972891]     meminfo_proc_show+0x40/0x4fc
> 
> And reason is red zone was not adjusted from object address.
> after adding fixup for redzone, backtrace is coming correct:
> / # cat /proc/meminfo
> [   14.870782]  slab kmalloc-64 start c8ab0140 data offset 64 pointer offset 128 size 64 allocated at meminfo_proc_show+0x40/0x4f4
> [   14.871817]     meminfo_proc_show+0x40/0x4f4
> [   14.872035]     seq_read_iter+0x18c/0x4c4
> [   14.872229]     proc_reg_read_iter+0x84/0xac
> [   14.872433]     generic_file_splice_read+0xe8/0x17c
> [   14.872621]     splice_direct_to_actor+0xb8/0x290
> [   14.872747]     do_splice_direct+0xa0/0xe0
> [   14.872896]     do_sendfile+0x2d0/0x438
> [   14.873044]     sys_sendfile64+0x12c/0x140
> [   14.873229]     ret_fast_syscall+0x0/0x58
> [   14.873372]     0xbe861de4
> 
> Signed-off-by: Vaneet Narang <v.narang@samsung.com>
> Signed-off-by: Maninder Singh <maninder1.s@samsung.com>

Good catch, thank you!  For the series:

Acked-by: Paul E. McKenney <paulmck@kernel.org>

On the other hand, if you would like me to take these, we need to get
a maintainer ack.

							Thanx, Paul

> ---
>  mm/slub.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/mm/slub.c b/mm/slub.c
> index 1912c4614248..9d13f0117ae6 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -4052,6 +4052,7 @@ void kmem_obj_info(struct kmem_obj_info *kpp, void *object, struct page *page)
>  	    !(s->flags & SLAB_STORE_USER))
>  		return;
>  #ifdef CONFIG_SLUB_DEBUG
> +	objp = fixup_red_left(s, objp);
>  	trackp = get_track(s, objp, TRACK_ALLOC);
>  	kpp->kp_ret = (void *)trackp->addr;
>  #ifdef CONFIG_STACKTRACE
> -- 
> 2.17.1
> 

Re: [PATCH 1/3] mm/slub: fixing backtrace of objects because of redzone adjustment

[Vlastimil Babka]

On 3/16/21 11:37 AM, Maninder Singh wrote:
> fixing commit 8e7f37f2aaa5 ("mm: Add mem_dump_obj() to print source
> of memory block")
> 
> with current code, Backtrace of allocated object is coming wrong:
> / # cat /proc/meminfo
> [   14.969843]  slab kmalloc-64 start c8ab0140 data offset 64 pointer offset 0 size 64 allocated at 0x6b6b6b6b
> [   14.970635]     0x6b6b6b6b
> [   14.970794]     0x6b6b6b6b
> [   14.970932]     0x6b6b6b6b
> [   14.971077]     0x6b6b6b6b
> [   14.971202]     0x6b6b6b6b
> [   14.971317]     0x6b6b6b6b
> [   14.971423]     0x6b6b6b6b
> [   14.971635]     0x6b6b6b6b
> [   14.971740]     0x6b6b6b6b
> [   14.971871]     0x6b6b6b6b
> [   14.972229]     0x6b6b6b6b
> [   14.972363]     0x6b6b6b6b
> [   14.972505]     0xa56b6b6b
> [   14.972631]     0xbbbbbbbb
> [   14.972734]     0xc8ab0400
> [   14.972891]     meminfo_proc_show+0x40/0x4fc
> 
> And reason is red zone was not adjusted from object address.
> after adding fixup for redzone, backtrace is coming correct:
> / # cat /proc/meminfo
> [   14.870782]  slab kmalloc-64 start c8ab0140 data offset 64 pointer offset 128 size 64 allocated at meminfo_proc_show+0x40/0x4f4
> [   14.871817]     meminfo_proc_show+0x40/0x4f4
> [   14.872035]     seq_read_iter+0x18c/0x4c4
> [   14.872229]     proc_reg_read_iter+0x84/0xac
> [   14.872433]     generic_file_splice_read+0xe8/0x17c
> [   14.872621]     splice_direct_to_actor+0xb8/0x290
> [   14.872747]     do_splice_direct+0xa0/0xe0
> [   14.872896]     do_sendfile+0x2d0/0x438
> [   14.873044]     sys_sendfile64+0x12c/0x140
> [   14.873229]     ret_fast_syscall+0x0/0x58
> [   14.873372]     0xbe861de4
> 
> Signed-off-by: Vaneet Narang <v.narang@samsung.com>
> Signed-off-by: Maninder Singh <maninder1.s@samsung.com>

Acked-by: Vlastimil Babka <vbabka@suse.cz>

> ---
>  mm/slub.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/mm/slub.c b/mm/slub.c
> index 1912c4614248..9d13f0117ae6 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -4052,6 +4052,7 @@ void kmem_obj_info(struct kmem_obj_info *kpp, void *object, struct page *page)
>  	    !(s->flags & SLAB_STORE_USER))
>  		return;
>  #ifdef CONFIG_SLUB_DEBUG
> +	objp = fixup_red_left(s, objp);
>  	trackp = get_track(s, objp, TRACK_ALLOC);
>  	kpp->kp_ret = (void *)trackp->addr;
>  #ifdef CONFIG_STACKTRACE
> 

Re: [PATCH 2/3] mm/slub: Add Support for free path information of an object.

[Vlastimil Babka]

On 3/16/21 11:37 AM, Maninder Singh wrote:
> Adding support for inforamtion of free path along with allocation
> path of an object:
> 
> slab kmalloc-64 start c8ab0140 data offset 64 pointer offset 0 size 64 allocated at meminfo_proc_show+0x40/0x4fc
> [   20.192078]     meminfo_proc_show+0x40/0x4fc
> [   20.192263]     seq_read_iter+0x18c/0x4c4
> [   20.192430]     proc_reg_read_iter+0x84/0xac
> [   20.192617]     generic_file_splice_read+0xe8/0x17c
> [   20.192816]     splice_direct_to_actor+0xb8/0x290
> [   20.193008]     do_splice_direct+0xa0/0xe0
> [   20.193185]     do_sendfile+0x2d0/0x438
> [   20.193345]     sys_sendfile64+0x12c/0x140
> [   20.193523]     ret_fast_syscall+0x0/0x58
> [   20.193695]     0xbeeacde4
> [   20.193822]  Free path:
> [   20.193935]     meminfo_proc_show+0x5c/0x4fc
> [   20.194115]     seq_read_iter+0x18c/0x4c4
> [   20.194285]     proc_reg_read_iter+0x84/0xac
> [   20.194475]     generic_file_splice_read+0xe8/0x17c
> [   20.194685]     splice_direct_to_actor+0xb8/0x290
> [   20.194870]     do_splice_direct+0xa0/0xe0
> [   20.195014]     do_sendfile+0x2d0/0x438
> [   20.195174]     sys_sendfile64+0x12c/0x140
> [   20.195336]     ret_fast_syscall+0x0/0x58
> [   20.195491]     0xbeeacde4
> 
> Co-developed-by: Vaneet Narang <v.narang@samsung.com>
> Signed-off-by: Vaneet Narang <v.narang@samsung.com>
> Signed-off-by: Maninder Singh <maninder1.s@samsung.com>

Acked-by: Vlastimil Babka <vbabka@suse.cz>

Re: [PATCH 2/3] mm/slub: Add Support for free path information of an object.

[Paul E. McKenney]

On Thu, Mar 18, 2021 at 01:35:37PM +0100, Vlastimil Babka wrote:
> On 3/16/21 11:37 AM, Maninder Singh wrote:
> > Adding support for inforamtion of free path along with allocation
> > path of an object:
> > 
> > slab kmalloc-64 start c8ab0140 data offset 64 pointer offset 0 size 64 allocated at meminfo_proc_show+0x40/0x4fc
> > [   20.192078]     meminfo_proc_show+0x40/0x4fc
> > [   20.192263]     seq_read_iter+0x18c/0x4c4
> > [   20.192430]     proc_reg_read_iter+0x84/0xac
> > [   20.192617]     generic_file_splice_read+0xe8/0x17c
> > [   20.192816]     splice_direct_to_actor+0xb8/0x290
> > [   20.193008]     do_splice_direct+0xa0/0xe0
> > [   20.193185]     do_sendfile+0x2d0/0x438
> > [   20.193345]     sys_sendfile64+0x12c/0x140
> > [   20.193523]     ret_fast_syscall+0x0/0x58
> > [   20.193695]     0xbeeacde4
> > [   20.193822]  Free path:
> > [   20.193935]     meminfo_proc_show+0x5c/0x4fc
> > [   20.194115]     seq_read_iter+0x18c/0x4c4
> > [   20.194285]     proc_reg_read_iter+0x84/0xac
> > [   20.194475]     generic_file_splice_read+0xe8/0x17c
> > [   20.194685]     splice_direct_to_actor+0xb8/0x290
> > [   20.194870]     do_splice_direct+0xa0/0xe0
> > [   20.195014]     do_sendfile+0x2d0/0x438
> > [   20.195174]     sys_sendfile64+0x12c/0x140
> > [   20.195336]     ret_fast_syscall+0x0/0x58
> > [   20.195491]     0xbeeacde4
> > 
> > Co-developed-by: Vaneet Narang <v.narang@samsung.com>
> > Signed-off-by: Vaneet Narang <v.narang@samsung.com>
> > Signed-off-by: Maninder Singh <maninder1.s@samsung.com>
> 
> Acked-by: Vlastimil Babka <vbabka@suse.cz>

I have queued 1/3 and 2/3, thank you both!

Would any of the ARM folks be willing to ack 3/3?

							Thanx, Paul