* [PATCH bpf-next] bpf: Fix kmemleak warnings for percpu hashmap
@ 2025-02-24 17:55 Yonghong Song
2025-02-24 19:47 ` Martin KaFai Lau
2025-02-24 20:20 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 3+ messages in thread
From: Yonghong Song @ 2025-02-24 17:55 UTC (permalink / raw)
To: bpf
Cc: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann, kernel-team,
Martin KaFai Lau, Vlad Poenaru
Vlad Poenaru from Meta reported the following kmemleak issues:
...
unreferenced object 0x606fd7c44ac8 (size 32):
comm "floodgate_agent", pid 5077, jiffies 4294746072
hex dump (first 32 bytes on cpu 32):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 0):
pcpu_alloc_noprof+0x730/0xeb0
bpf_map_alloc_percpu+0x69/0xc0
prealloc_init+0x9d/0x1b0
htab_map_alloc+0x363/0x510
map_create+0x215/0x3a0
__sys_bpf+0x16b/0x3e0
__x64_sys_bpf+0x18/0x20
do_syscall_64+0x7b/0x150
entry_SYSCALL_64_after_hwframe+0x4b/0x53
unreferenced object 0x606fd7c44ae8 (size 32):
comm "floodgate_agent", pid 5077, jiffies 4294746072
hex dump (first 32 bytes on cpu 32):
d3 08 00 00 00 00 00 00 d3 08 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc d197b0fe):
pcpu_alloc_noprof+0x730/0xeb0
bpf_map_alloc_percpu+0x69/0xc0
prealloc_init+0x9d/0x1b0
htab_map_alloc+0x363/0x510
map_create+0x215/0x3a0
__sys_bpf+0x16b/0x3e0
__x64_sys_bpf+0x18/0x20
do_syscall_64+0x7b/0x150
entry_SYSCALL_64_after_hwframe+0x4b/0x53
...
Further investigation shows the reason is due to not 8-byte aligned
store of percpu pointer in htab_elem_set_ptr():
*(void __percpu **)(l->key + key_size) = pptr;
Note that the whole htab_elem alignment is 8 (for x86_64). If the key_size
is 4, that means pptr is stored in a location which is 4 byte aligned but
not 8 byte aligned. In mm/kmemleak.c, scan_block() scans the memory based
on 8 byte stride, so it won't detect above pptr, hence reporting the memory
leak.
In htab_map_alloc(), we already have
htab->elem_size = sizeof(struct htab_elem) +
round_up(htab->map.key_size, 8);
if (percpu)
htab->elem_size += sizeof(void *);
else
htab->elem_size += round_up(htab->map.value_size, 8);
So storing pptr with 8-byte alignment won't cause any problem and can fix
kmemleak too.
The issue can be reproduced with bpf selftest as well:
1. Enable CONFIG_DEBUG_KMEMLEAK config
2. Add a getchar() before skel destroy in test_hash_map() in prog_tests/for_each.c.
The purpose is to keep map available so kmemleak can be detected.
3. run './test_progs -t for_each/hash_map &' and a kmemleak should be reported.
unreferenced object 0x607e08c1fd30 (size 8):
comm "test_progs", pid 1969, jiffies 4294706961
hex dump (first 8 bytes on cpu 2):
03 00 00 00 00 00 00 00 ........
backtrace (crc 844a0efa):
pcpu_alloc_noprof+0xf33/0x14a0
bpf_map_alloc_percpu+0x9c/0x200
prealloc_init+0x1e7/0x730
htab_map_alloc+0x698/0xc70
map_create+0x489/0xcb0
__sys_bpf+0x443/0x560
__x64_sys_bpf+0x7c/0x90
do_syscall_64+0x58/0xf0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
cc: Vlad Poenaru <thevlad@meta.com>
Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
---
kernel/bpf/hashtab.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index 4a9eeb7aef85..c308300fc72f 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -198,12 +198,12 @@ static bool htab_is_percpu(const struct bpf_htab *htab)
static inline void htab_elem_set_ptr(struct htab_elem *l, u32 key_size,
void __percpu *pptr)
{
- *(void __percpu **)(l->key + key_size) = pptr;
+ *(void __percpu **)(l->key + roundup(key_size, 8)) = pptr;
}
static inline void __percpu *htab_elem_get_ptr(struct htab_elem *l, u32 key_size)
{
- return *(void __percpu **)(l->key + key_size);
+ return *(void __percpu **)(l->key + roundup(key_size, 8));
}
static void *fd_htab_map_get_ptr(const struct bpf_map *map, struct htab_elem *l)
@@ -2354,7 +2354,7 @@ static int htab_percpu_map_gen_lookup(struct bpf_map *map, struct bpf_insn *insn
*insn++ = BPF_EMIT_CALL(__htab_map_lookup_elem);
*insn++ = BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3);
*insn++ = BPF_ALU64_IMM(BPF_ADD, BPF_REG_0,
- offsetof(struct htab_elem, key) + map->key_size);
+ offsetof(struct htab_elem, key) + roundup(map->key_size, 8));
*insn++ = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0);
*insn++ = BPF_MOV64_PERCPU_REG(BPF_REG_0, BPF_REG_0);
--
2.43.5
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH bpf-next] bpf: Fix kmemleak warnings for percpu hashmap
2025-02-24 17:55 [PATCH bpf-next] bpf: Fix kmemleak warnings for percpu hashmap Yonghong Song
@ 2025-02-24 19:47 ` Martin KaFai Lau
2025-02-24 20:20 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Martin KaFai Lau @ 2025-02-24 19:47 UTC (permalink / raw)
To: Yonghong Song, bpf
Cc: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann, kernel-team,
Martin KaFai Lau, Vlad Poenaru
On 2/24/25 9:55 AM, Yonghong Song wrote:
> Vlad Poenaru from Meta reported the following kmemleak issues:
>
> ...
> unreferenced object 0x606fd7c44ac8 (size 32):
> comm "floodgate_agent", pid 5077, jiffies 4294746072
> hex dump (first 32 bytes on cpu 32):
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> backtrace (crc 0):
> pcpu_alloc_noprof+0x730/0xeb0
> bpf_map_alloc_percpu+0x69/0xc0
> prealloc_init+0x9d/0x1b0
> htab_map_alloc+0x363/0x510
> map_create+0x215/0x3a0
> __sys_bpf+0x16b/0x3e0
> __x64_sys_bpf+0x18/0x20
> do_syscall_64+0x7b/0x150
> entry_SYSCALL_64_after_hwframe+0x4b/0x53
> unreferenced object 0x606fd7c44ae8 (size 32):
> comm "floodgate_agent", pid 5077, jiffies 4294746072
> hex dump (first 32 bytes on cpu 32):
> d3 08 00 00 00 00 00 00 d3 08 00 00 00 00 00 00 ................
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> backtrace (crc d197b0fe):
> pcpu_alloc_noprof+0x730/0xeb0
> bpf_map_alloc_percpu+0x69/0xc0
> prealloc_init+0x9d/0x1b0
> htab_map_alloc+0x363/0x510
> map_create+0x215/0x3a0
> __sys_bpf+0x16b/0x3e0
> __x64_sys_bpf+0x18/0x20
> do_syscall_64+0x7b/0x150
> entry_SYSCALL_64_after_hwframe+0x4b/0x53
> ...
>
> Further investigation shows the reason is due to not 8-byte aligned
> store of percpu pointer in htab_elem_set_ptr():
> *(void __percpu **)(l->key + key_size) = pptr;
>
> Note that the whole htab_elem alignment is 8 (for x86_64). If the key_size
> is 4, that means pptr is stored in a location which is 4 byte aligned but
> not 8 byte aligned. In mm/kmemleak.c, scan_block() scans the memory based
> on 8 byte stride, so it won't detect above pptr, hence reporting the memory
> leak.
>
> In htab_map_alloc(), we already have
>
> htab->elem_size = sizeof(struct htab_elem) +
> round_up(htab->map.key_size, 8);
> if (percpu)
> htab->elem_size += sizeof(void *);
> else
> htab->elem_size += round_up(htab->map.value_size, 8);
>
> So storing pptr with 8-byte alignment won't cause any problem and can fix
> kmemleak too.
Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH bpf-next] bpf: Fix kmemleak warnings for percpu hashmap
2025-02-24 17:55 [PATCH bpf-next] bpf: Fix kmemleak warnings for percpu hashmap Yonghong Song
2025-02-24 19:47 ` Martin KaFai Lau
@ 2025-02-24 20:20 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2025-02-24 20:20 UTC (permalink / raw)
To: Yonghong Song; +Cc: bpf, ast, andrii, daniel, kernel-team, martin.lau, thevlad
Hello:
This patch was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@kernel.org>:
On Mon, 24 Feb 2025 09:55:14 -0800 you wrote:
> Vlad Poenaru from Meta reported the following kmemleak issues:
>
> ...
> unreferenced object 0x606fd7c44ac8 (size 32):
> comm "floodgate_agent", pid 5077, jiffies 4294746072
> hex dump (first 32 bytes on cpu 32):
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> backtrace (crc 0):
> pcpu_alloc_noprof+0x730/0xeb0
> bpf_map_alloc_percpu+0x69/0xc0
> prealloc_init+0x9d/0x1b0
> htab_map_alloc+0x363/0x510
> map_create+0x215/0x3a0
> __sys_bpf+0x16b/0x3e0
> __x64_sys_bpf+0x18/0x20
> do_syscall_64+0x7b/0x150
> entry_SYSCALL_64_after_hwframe+0x4b/0x53
> unreferenced object 0x606fd7c44ae8 (size 32):
> comm "floodgate_agent", pid 5077, jiffies 4294746072
> hex dump (first 32 bytes on cpu 32):
> d3 08 00 00 00 00 00 00 d3 08 00 00 00 00 00 00 ................
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> backtrace (crc d197b0fe):
> pcpu_alloc_noprof+0x730/0xeb0
> bpf_map_alloc_percpu+0x69/0xc0
> prealloc_init+0x9d/0x1b0
> htab_map_alloc+0x363/0x510
> map_create+0x215/0x3a0
> __sys_bpf+0x16b/0x3e0
> __x64_sys_bpf+0x18/0x20
> do_syscall_64+0x7b/0x150
> entry_SYSCALL_64_after_hwframe+0x4b/0x53
> ...
>
> [...]
Here is the summary with links:
- [bpf-next] bpf: Fix kmemleak warnings for percpu hashmap
https://git.kernel.org/bpf/bpf-next/c/11ba7ce076e5
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-02-24 20:19 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-02-24 17:55 [PATCH bpf-next] bpf: Fix kmemleak warnings for percpu hashmap Yonghong Song
2025-02-24 19:47 ` Martin KaFai Lau
2025-02-24 20:20 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox