Fwd: Debugger for mapcount/reference counting issues

Fwd: Debugger for mapcount/reference counting issues

[Adrian Johnston]

I was just reading an article about the long running
mapcount/reference counting issues in the kernel over on LWN.
https://lwn.net/Articles/1013956/bigpage

And I'd like to make a recommendation in this ongoing discussion.

The kernel would benefit from a reference count debugger.  This is a
debug build only tool that keeps track of the owner of each increment
to a reference count and then confirms that each call to release a
reference count has an owner that matches an increment by a previously
registered owner.  This enforces an ownership match between allocation
and release of each reference count increment, even in ad hoc code. It
would also be able to validate the reference counter independently
when resources are being processed, created and destroyed.

Ideally this tool would be able to show calls stacks associated with
release operations that have unregistered owners and call stacks for
leaked reference increments at system shutdown.  Having this type of
tool enabled on your integration build (linux-next) might save you a
lot of debugging.

Personally, I don't think this is a good problem to have and would
argue that every resource should have a single owner that arbitrates
it's life cycle.  But there are tools that can help if reference
counting is necessary.

All the best,
Adrian Johnston

Re: Fwd: Debugger for mapcount/reference counting issues

[Omar Sandoval]

On Fri, Mar 28, 2025 at 08:24:47PM -0700, Adrian Johnston wrote:
> I was just reading an article about the long running
> mapcount/reference counting issues in the kernel over on LWN.
> https://lwn.net/Articles/1013956/bigpage
> 
> And I'd like to make a recommendation in this ongoing discussion.
> 
> The kernel would benefit from a reference count debugger.  This is a
> debug build only tool that keeps track of the owner of each increment
> to a reference count and then confirms that each call to release a
> reference count has an owner that matches an increment by a previously
> registered owner.  This enforces an ownership match between allocation
> and release of each reference count increment, even in ad hoc code. It
> would also be able to validate the reference counter independently
> when resources are being processed, created and destroyed.
> 
> Ideally this tool would be able to show calls stacks associated with
> release operations that have unregistered owners and call stacks for
> leaked reference increments at system shutdown.  Having this type of
> tool enabled on your integration build (linux-next) might save you a
> lot of debugging.
> 
> Personally, I don't think this is a good problem to have and would
> argue that every resource should have a single owner that arbitrates
> it's life cycle.  But there are tools that can help if reference
> counting is necessary.
> 
> All the best,
> Adrian Johnston

Hi,

What you described sounds very similar to ref_tracker:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/linux/ref_tracker.h
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4e66934eaadc83b27ada8d42b60894018f3bfabf

It doesn't seem to be used very widely, but it has proven useful for
debugging network namespace leaks.

Thanks,
Omar