Re: [PATCH 3/3] mm: kmemleak: raise min_unref_scans to 3 for verbose auto-scan

[Breno Leitao <leitao@debian.org>]

On Fri, Sep 18, 2026 at 10:21:09AM +0100, Catalin Marinas wrote:
> On Thu, Sep 17, 2026 at 03:04:43PM -0700, Andrew Morton wrote:
> > On Thu, 17 Sep 2026 06:47:37 -0700 Breno Leitao <leitao@debian.org> wrote:
> >
> > > CONFIG_DEBUG_KMEMLEAK_VERBOSE sends every report to the console, so a
> > > transient false positive there is broadcast to whatever collects the
> > > kernel log rather than sitting in the debugfs file until someone looks.
> > > That asymmetry justifies being more conservative than the general case.
> > >
> > > Require one more consecutive unreferenced scan before reporting. The
> > > only cost is that a genuine leak is reported one scan interval later
> > > (600s by default); the value stays writable at run time through the
> > > module parameter.
> > >
> > > Kernels without CONFIG_DEBUG_KMEMLEAK_VERBOSE keep reporting on the
> > > first unreferenced scan.
> > >
> > > I've been running constant upstream kernel with
> > > CONFIG_DEBUG_KMEMLEAK_VERBOSE set, and I am still seeing some rare false
> > > positive, that goes away with min_unref_scans=3, so, making it the
> > > default based on my heuristic.
> >
> > I'm guessing going from 2 to 3 reduces the false-positive reporting
> > rate, but they're still possible.
> >
> > It all sounds rather rubbery.  Why do these false positives occur,
> > anyway?  Are we papering over a fundamental problem by filtering out
> > its user-visible effects?
>
> The fundamental problem is that we can't do a stop-machine for the
> kmemleak scanning. When scanning takes tens of seconds, pointers may
> move around memory or registers on other CPUs, so kmemleak could miss
> them. It's all probabilistic, hoping that we won't hit the same object
> two or three times in a row, 10min apart (for lack of better ideas). We
> have other heuristics like checksumming but they don't seem to be
> sufficient when testing on a large scale.

In fact, in my investigation there's only a single use case where I
actually see this false positive, which go away with this new approch.

And I have a very solidy test setup where linux-next is deployed daily
and run for 24 hours, until the next kernel replaces it. This is on real
hardware with some basic workloads, so, in fact the false positive
(given the design above) is quite low.