Re: + radix-tree-fix-kmemleak-false-positives-on-tree-head-reassignment.patch added to mm-new branch

[Breno Leitao <leitao@debian.org>]

Hello Catalin,

On Mon, Jul 06, 2026 at 12:39:30PM +0100, Catalin Marinas wrote:
> On Mon, Jul 06, 2026 at 03:41:54AM -0700, Breno Leitao wrote:
> > On Sun, Jul 05, 2026 at 11:45:04AM +0100, Matthew Wilcox wrote:
> > > > Add a matching kmemleak_transient_leak() stub to the radix tree test
> > > > harness so the userspace lib/radix-tree.c build keeps building.
> > >
> > > Last time this was proposed, the suggestion was that kmemleak needed to
> > > be fixed.
> > >
> > > https://lore.kernel.org/all/aCyI8T2sWlPLEYZ_@arm.com/
> > 
> > My understanding from that thread is that kmemleak could be made more
> > reliable by explicitly waiting for a rescan before reporting (which it
> > is a great addition).
> > 
> > This patch explictly tell kmemleak that this object will be temporarily
> > unreferenced, which is more cooperative.
> > 
> > That said, I believe both approaches. This transient-leak annotation and
> > Catalin's earlier proposal—can coexist as complementary mechanisms to
> > reduce kmemleak false positives (which has been my goal, given I run
> > kmemleak-enabled kernel at some scale)
> 
> I'm not happy with the transient leak annotations either but couldn't
> come up with something better. The last year's proposal to reset the
> checksum pretty much forces it to go through one more scan, something
> your patches already do, though maybe we could change the default.
> 
> I wonder whether we should force the scanning to happen twice in a row
> and drop the min_unref_count. Those transient leaks happen because of
> some micro/milliseconds miss of a pointer. If we have new white objects
> of the end of a scan, go one more round through the root and gray
> objects (but do not reset them to white) and only then report the leaks.
> If the white objects have been reported already or we don't have any
> left, skip this additional scan or bail out early. We could have a
> tunable for this one to go 2-3 times if needed, though I guess twice is
> sufficient. The interface is also preserved as you do an echo scan only
> once (or twice initially with the checksum calculation).

That is a good proposal, and I am happy to hack it up.

On the other side, I _think_ we want to have both approaches
(your rescan-after-white) and min_unref_count. They serve different
purposes. This is how I see them serving different purposes:

1) This rescan-after-white proposal:

  Target: Developers that cat manually scanning for leaks when they
  develop something.

    a) The goal is to produce a memory leaks after the scan is done.
    b) Latency is more important than false positives
    c) min_unref_count = 1

2) min_unref_count 

  Target: Production servers running kmemleak on some cloud "probe
  points", where the service will run for hours/days.

    a) Latency is not important (system is automatically deployed and
    tested)
    b) False positives is heavily undesirable. It causes an alarm to get
    some engineer to investigate.
    c) In this case min_unref_count will be super high (>10)
      - I.e, just report when you are pretty sure this is a real issue.
   
Anyway, that's what I'm seeing from my angle. Let me know if I'm way
off.