From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751457AbdEPG2M (ORCPT ); Tue, 16 May 2017 02:28:12 -0400 Received: from mx2.suse.de ([195.135.220.15]:43246 "EHLO mx1.suse.de" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751011AbdEPG2L (ORCPT ); Tue, 16 May 2017 02:28:11 -0400 Date: Tue, 16 May 2017 08:28:07 +0200 From: Michal Hocko To: "Luis R. Rodriguez" Cc: Andy Lutomirski , Andrew Morton , Ingo Molnar , Andy Lutomirski , Kees Cook , "Eric W. Biederman" , Mateusz Guzik , "linux-kernel@vger.kernel.org" , Catalin Marinas Subject: Re: kmemleak splat on copy_process() Message-ID: <20170516062806.GC30277@dhcp22.suse.cz> References: <20170206094741.GB3097@dhcp22.suse.cz> <20170207013702.GF24047@wotan.suse.de> <20170207080343.GA5065@dhcp22.suse.cz> <20170209013732.GL24047@wotan.suse.de> <20170515215317.GC17314@wotan.suse.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170515215317.GC17314@wotan.suse.de> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Let's CC Catalin this smells like a kmemleak bug to me. On Mon 15-05-17 23:53:18, Luis R. Rodriguez wrote: > On Fri, Feb 17, 2017 at 11:32:34AM -0800, Andy Lutomirski wrote: > > On Fri, Feb 17, 2017 at 9:23 AM, Luis R. Rodriguez wrote: > > > On Fri, Feb 17, 2017 at 9:07 AM, Andy Lutomirski wrote: > > >> But maybe > > >> there really is a race in which a kmemleak check right in the middle > > >> of duplicating the task struct really can't see the stack pointer. > > > > > > Funny, but it was actually using kmemleak how I can easily reproduce: > > > > > > To reproduce the kmemleak splat: > > > > > > echo clear > /sys/kernel/debug/kmemleak > > > echo scan > /sys/kernel/debug/kmemleak > > > cat /sys/kernel/debug/kmemleak > > > > Worked fine for me. Maybe your config is special? > > I don't think my config is special at all, here it is its just > what I use for my qemu kvm guest image: > > http://drvbp1.linux-foundation.org/~mcgrof/2017/05/15/configs/piggy-x86_64_qemu_fork_kmemleak.config > > Another new kernel (next-20170515 based now on v4.12-rc1) and yet the same > kmemleeak can be triggered easily, although this time I need to hit "scan" > quite a bit more -- try using scan 6 times in a row or so. > > echo clear > /sys/kernel/debug/kmemleak > echo scan > /sys/kernel/debug/kmemleak > echo scan > /sys/kernel/debug/kmemleak > echo scan > /sys/kernel/debug/kmemleak > echo scan > /sys/kernel/debug/kmemleak > echo scan > /sys/kernel/debug/kmemleak > cat /sys/kernel/debug/kmemleak > > root@piggy:~# cat /sys/kernel/debug/kmemleak > unreferenced object 0xffffa07500d4c000 (size 16384): > comm "bash", pid 1349, jiffies 4294895999 (age 263.204s) > hex dump (first 32 bytes): > 9d 6e ac 57 00 00 00 00 00 00 00 00 00 00 00 00 .n.W............ > 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > backtrace: > [] kmemleak_alloc+0x4a/0xa0 > [] __vmalloc_node_range+0x20c/0x2b0 > [] copy_process.part.37+0x5c2/0x1af0 > [] _do_fork+0xcf/0x390 > [] SyS_clone+0x19/0x20 > [] do_syscall_64+0x5b/0xc0 > [] return_from_SYSCALL_64+0x0/0x6a > [] 0xffffffffffffffff > unreferenced object 0xffffa07500c30000 (size 16384): > comm "bash", pid 1394, jiffies 4294940106 (age 86.780s) > hex dump (first 32 bytes): > 9d 6e ac 57 00 00 00 00 00 00 00 00 00 00 00 00 .n.W............ > 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > backtrace: > [] kmemleak_alloc+0x4a/0xa0 > [] __vmalloc_node_range+0x20c/0x2b0 > [] copy_process.part.37+0x5c2/0x1af0 > [] _do_fork+0xcf/0x390 > [] SyS_clone+0x19/0x20 > [] do_syscall_64+0x5b/0xc0 > [] return_from_SYSCALL_64+0x0/0x6a > [] 0xffffffffffffffff > unreferenced object 0xffffa07500c98000 (size 16384): > comm "bash", pid 1368, jiffies 4294956480 (age 21.284s) > hex dump (first 32 bytes): > 9d 6e ac 57 00 00 00 00 00 00 00 00 fe 01 00 00 .n.W............ > c0 f4 9d 44 2f e8 ff ff 00 de ac 44 2f e8 ff ff ...D/......D/... > backtrace: > [] kmemleak_alloc+0x4a/0xa0 > [] __vmalloc_node_range+0x20c/0x2b0 > [] copy_process.part.37+0x5c2/0x1af0 > [] _do_fork+0xcf/0x390 > [] SyS_clone+0x19/0x20 > [] do_syscall_64+0x5b/0xc0 > [] return_from_SYSCALL_64+0x0/0x6a > [] 0xffffffffffffffff > > I confirm that stack is allocated and that a respective tsk->stack_vm_area gets > assigned. So neither of these BUG() triggers, for instance but yet the kmemleak > does: > > diff --git a/kernel/fork.c b/kernel/fork.c > index 657373b2ddd2..9bd7ccd55b89 100644 > --- a/kernel/fork.c > +++ b/kernel/fork.c > @@ -230,8 +230,12 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node) > * free_thread_stack() can be called in interrupt context, > * so cache the vm_struct. > */ > - if (stack) > + if (stack) { > tsk->stack_vm_area = find_vm_area(stack); > + if (!tsk->stack_vm_area) > + BUG(); > + } else > + BUG(); > return stack; > #else > struct page *page = alloc_pages_node(node, THREADINFO_GFP, > > > > Luis -- Michal Hocko SUSE Labs