From: "Luis R. Rodriguez" <mcgrof@kernel.org>
To: Andy Lutomirski <luto@amacapital.net>
Cc: "Luis R. Rodriguez" <mcgrof@kernel.org>,
Michal Hocko <mhocko@kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
Ingo Molnar <mingo@kernel.org>, Andy Lutomirski <luto@kernel.org>,
Kees Cook <keescook@chromium.org>,
"Eric W. Biederman" <ebiederm@xmission.com>,
Mateusz Guzik <mguzik@redhat.com>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: kmemleak splat on copy_process()
Date: Mon, 15 May 2017 23:53:18 +0200 [thread overview]
Message-ID: <20170515215317.GC17314@wotan.suse.de> (raw)
In-Reply-To: <CALCETrXEE0p8foSTGqMSgG_nDEVNBHu75FJZ-ivS7tnUjzFDLg@mail.gmail.com>
On Fri, Feb 17, 2017 at 11:32:34AM -0800, Andy Lutomirski wrote:
> On Fri, Feb 17, 2017 at 9:23 AM, Luis R. Rodriguez <mcgrof@kernel.org> wrote:
> > On Fri, Feb 17, 2017 at 9:07 AM, Andy Lutomirski <luto@amacapital.net> wrote:
> >> But maybe
> >> there really is a race in which a kmemleak check right in the middle
> >> of duplicating the task struct really can't see the stack pointer.
> >
> > Funny, but it was actually using kmemleak how I can easily reproduce:
> >
> > To reproduce the kmemleak splat:
> >
> > echo clear > /sys/kernel/debug/kmemleak
> > echo scan > /sys/kernel/debug/kmemleak
> > cat /sys/kernel/debug/kmemleak
>
> Worked fine for me. Maybe your config is special?
I don't think my config is special at all, here it is its just
what I use for my qemu kvm guest image:
http://drvbp1.linux-foundation.org/~mcgrof/2017/05/15/configs/piggy-x86_64_qemu_fork_kmemleak.config
Another new kernel (next-20170515 based now on v4.12-rc1) and yet the same
kmemleeak can be triggered easily, although this time I need to hit "scan"
quite a bit more -- try using scan 6 times in a row or so.
echo clear > /sys/kernel/debug/kmemleak
echo scan > /sys/kernel/debug/kmemleak
echo scan > /sys/kernel/debug/kmemleak
echo scan > /sys/kernel/debug/kmemleak
echo scan > /sys/kernel/debug/kmemleak
echo scan > /sys/kernel/debug/kmemleak
cat /sys/kernel/debug/kmemleak
root@piggy:~# cat /sys/kernel/debug/kmemleak
unreferenced object 0xffffa07500d4c000 (size 16384):
comm "bash", pid 1349, jiffies 4294895999 (age 263.204s)
hex dump (first 32 bytes):
9d 6e ac 57 00 00 00 00 00 00 00 00 00 00 00 00 .n.W............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffffa5464cca>] kmemleak_alloc+0x4a/0xa0
[<ffffffffa4fdfe6c>] __vmalloc_node_range+0x20c/0x2b0
[<ffffffffa4e7d1a2>] copy_process.part.37+0x5c2/0x1af0
[<ffffffffa4e7e89f>] _do_fork+0xcf/0x390
[<ffffffffa4e7ec09>] SyS_clone+0x19/0x20
[<ffffffffa4e03b0b>] do_syscall_64+0x5b/0xc0
[<ffffffffa547072b>] return_from_SYSCALL_64+0x0/0x6a
[<ffffffffffffffff>] 0xffffffffffffffff
unreferenced object 0xffffa07500c30000 (size 16384):
comm "bash", pid 1394, jiffies 4294940106 (age 86.780s)
hex dump (first 32 bytes):
9d 6e ac 57 00 00 00 00 00 00 00 00 00 00 00 00 .n.W............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffffa5464cca>] kmemleak_alloc+0x4a/0xa0
[<ffffffffa4fdfe6c>] __vmalloc_node_range+0x20c/0x2b0
[<ffffffffa4e7d1a2>] copy_process.part.37+0x5c2/0x1af0
[<ffffffffa4e7e89f>] _do_fork+0xcf/0x390
[<ffffffffa4e7ec09>] SyS_clone+0x19/0x20
[<ffffffffa4e03b0b>] do_syscall_64+0x5b/0xc0
[<ffffffffa547072b>] return_from_SYSCALL_64+0x0/0x6a
[<ffffffffffffffff>] 0xffffffffffffffff
unreferenced object 0xffffa07500c98000 (size 16384):
comm "bash", pid 1368, jiffies 4294956480 (age 21.284s)
hex dump (first 32 bytes):
9d 6e ac 57 00 00 00 00 00 00 00 00 fe 01 00 00 .n.W............
c0 f4 9d 44 2f e8 ff ff 00 de ac 44 2f e8 ff ff ...D/......D/...
backtrace:
[<ffffffffa5464cca>] kmemleak_alloc+0x4a/0xa0
[<ffffffffa4fdfe6c>] __vmalloc_node_range+0x20c/0x2b0
[<ffffffffa4e7d1a2>] copy_process.part.37+0x5c2/0x1af0
[<ffffffffa4e7e89f>] _do_fork+0xcf/0x390
[<ffffffffa4e7ec09>] SyS_clone+0x19/0x20
[<ffffffffa4e03b0b>] do_syscall_64+0x5b/0xc0
[<ffffffffa547072b>] return_from_SYSCALL_64+0x0/0x6a
[<ffffffffffffffff>] 0xffffffffffffffff
I confirm that stack is allocated and that a respective tsk->stack_vm_area gets
assigned. So neither of these BUG() triggers, for instance but yet the kmemleak
does:
diff --git a/kernel/fork.c b/kernel/fork.c
index 657373b2ddd2..9bd7ccd55b89 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -230,8 +230,12 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node)
* free_thread_stack() can be called in interrupt context,
* so cache the vm_struct.
*/
- if (stack)
+ if (stack) {
tsk->stack_vm_area = find_vm_area(stack);
+ if (!tsk->stack_vm_area)
+ BUG();
+ } else
+ BUG();
return stack;
#else
struct page *page = alloc_pages_node(node, THREADINFO_GFP,
Luis
next prev parent reply other threads:[~2017-05-15 21:53 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-02-03 21:06 kmemleak splat on copy_process() Luis R. Rodriguez
2017-02-06 9:47 ` Michal Hocko
2017-02-07 1:37 ` Luis R. Rodriguez
2017-02-07 8:03 ` Michal Hocko
2017-02-09 1:37 ` Luis R. Rodriguez
2017-02-17 17:07 ` Andy Lutomirski
2017-02-17 17:23 ` Luis R. Rodriguez
2017-02-17 19:32 ` Andy Lutomirski
2017-05-15 21:53 ` Luis R. Rodriguez [this message]
2017-05-16 6:28 ` Michal Hocko
2017-05-16 13:39 ` Catalin Marinas
2017-05-16 23:55 ` Andy Lutomirski
2017-05-17 11:09 ` Catalin Marinas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170515215317.GC17314@wotan.suse.de \
--to=mcgrof@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=ebiederm@xmission.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=luto@kernel.org \
--cc=mguzik@redhat.com \
--cc=mhocko@kernel.org \
--cc=mingo@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).