[2.6.31] Memory leak in load_module()?

[2.6.31] Memory leak in load_module()?

[Tetsuo Handa]

Hello.

I changed CONFIG_DEBUG_KMEMLEAK_EARLY_LOG_SIZE to 2000 and did

# insmod /lib/modules/2.6.31/kernel/drivers/edac/r82600_edac.ko
insmod: error inserting '/lib/modules/2.6.31/kernel/drivers/edac/r82600_edac.ko': -1 Unknown symbol in module
# echo scan > /sys/kernel/debug/kmemleak
# dmesg
r82600_edac: Unknown symbol edac_mc_del_mc
r82600_edac: Unknown symbol edac_mc_add_mc
r82600_edac: Unknown symbol edac_pci_create_generic_ctl
r82600_edac: Unknown symbol edac_mc_alloc
r82600_edac: Unknown symbol edac_mc_find_csrow_by_page
r82600_edac: Unknown symbol edac_mc_free
r82600_edac: Unknown symbol edac_mc_handle_ce
r82600_edac: Unknown symbol edac_mc_handle_ue
r82600_edac: Unknown symbol edac_pci_release_generic_ctl
kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
# tail -n 4 /sys/kernel/debug/kmemleak
unreferenced object 0xd643a788 (size 32):
  comm "insmod", pid 2854, jiffies 4294791099
  backtrace:
    [<ffffffff>] 0xffffffff

Is this real memory leak?

I used CentOS 5.3 on i686.
Config is at http://I-love.SAKURA.ne.jp/tmp/config-2.6.31

Regards.

Re: [2.6.31] Memory leak in load_module()?

[Catalin Marinas]

Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> wrote:
> I changed CONFIG_DEBUG_KMEMLEAK_EARLY_LOG_SIZE to 2000 and did
>
> # insmod /lib/modules/2.6.31/kernel/drivers/edac/r82600_edac.ko
> insmod: error inserting '/lib/modules/2.6.31/kernel/drivers/edac/r82600_edac.ko': -1 Unknown symbol in module
> # echo scan > /sys/kernel/debug/kmemleak
> # dmesg
> r82600_edac: Unknown symbol edac_mc_del_mc
> r82600_edac: Unknown symbol edac_mc_add_mc
> r82600_edac: Unknown symbol edac_pci_create_generic_ctl
> r82600_edac: Unknown symbol edac_mc_alloc
> r82600_edac: Unknown symbol edac_mc_find_csrow_by_page
> r82600_edac: Unknown symbol edac_mc_free
> r82600_edac: Unknown symbol edac_mc_handle_ce
> r82600_edac: Unknown symbol edac_mc_handle_ue
> r82600_edac: Unknown symbol edac_pci_release_generic_ctl
> kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
> # tail -n 4 /sys/kernel/debug/kmemleak
> unreferenced object 0xd643a788 (size 32):
>   comm "insmod", pid 2854, jiffies 4294791099
>   backtrace:
>     [<ffffffff>] 0xffffffff
>
> Is this real memory leak?

It could be but isn't stack tracing enabled on your system? The
backtrace doesn't seem very useful.

-- 
Catalin

Re: [2.6.31] Memory leak in load_module()?

[Tetsuo Handa]

Hello.

Catalin Marinas wrote:
> It could be but isn't stack tracing enabled on your system? The
> backtrace doesn't seem very useful.

Since the kernel hangs after printing

[    0.000999]  memory used by lock dependency info: 3743 kB
[    0.000999]  per task-struct memory footprint: 1920 bytes

if I enable almost all debug options and change
CONFIG_DEBUG_KMEMLEAK_EARLY_LOG_SIZE to 2000,
I disabled almost all debug options.

OK. Here is the output with CONFIG_FRAME_POINTER=y .
Do I need to enable some other debug options?

unreferenced object 0xdd7c1718 (size 32):
  comm "insmod", pid 2859, jiffies 4294757534
  backtrace:
    [<c048a210>] create_object+0x135/0x202
    [<c048a302>] kmemleak_alloc+0x25/0x49
    [<c04865bd>] kmemleak_alloc_recursive+0x1c/0x22
    [<c0486e27>] __kmalloc_track_caller+0x66/0xb3
    [<c0473980>] kstrdup+0x2c/0x4e
    [<c044716a>] setup_modinfo_srcversion+0x12/0x1b
    [<c0448725>] load_module+0x866/0x124a
    [<c0449180>] sys_init_module+0x49/0x1b9
    [<c0402a24>] sysenter_do_call+0x12/0x22
    [<ffffffff>] 0xffffffff

Regards.

Re: [2.6.31] Memory leak in load_module()?

[Catalin Marinas]

On Fri, 2009-09-11 at 19:58 +0900, Tetsuo Handa wrote:
> OK. Here is the output with CONFIG_FRAME_POINTER=y .
> Do I need to enable some other debug options?
> 
> unreferenced object 0xdd7c1718 (size 32):
>   comm "insmod", pid 2859, jiffies 4294757534
>   backtrace:
>     [<c048a210>] create_object+0x135/0x202
>     [<c048a302>] kmemleak_alloc+0x25/0x49
>     [<c04865bd>] kmemleak_alloc_recursive+0x1c/0x22
>     [<c0486e27>] __kmalloc_track_caller+0x66/0xb3
>     [<c0473980>] kstrdup+0x2c/0x4e
>     [<c044716a>] setup_modinfo_srcversion+0x12/0x1b
>     [<c0448725>] load_module+0x866/0x124a
>     [<c0449180>] sys_init_module+0x49/0x1b9
>     [<c0402a24>] sysenter_do_call+0x12/0x22
>     [<ffffffff>] 0xffffffff

The object above was allocated by kstrdup via setup_modinfo_srcversion
but the module loading failed and no other kernel part freed the
mod->filed object. I think it's a real leak but you could try a few
"echo scan" to make sure it's not just a temporary false positive.

(the kmemleak branch on git://linux-arm.org/linux-2.6.git has a patch
which dumps the first few bytes from the object and sometimes this
helps; I'll send a pull request to Linus sometime today)

-- 
Catalin

Re: [2.6.31] Memory leak in load_module()?

[Tetsuo Handa]

Catalin Marinas wrote:
> The object above was allocated by kstrdup via setup_modinfo_srcversion
> but the module loading failed and no other kernel part freed the
> mod->filed object. I think it's a real leak but you could try a few
> "echo scan" to make sure it's not just a temporary false positive.
I did

  while : ; do insmod /lib/modules/2.6.31/kernel/drivers/edac/r82600_edac.ko; sleep 1; echo scan > /sys/kernel/debug/kmemleak ; sleep 10; dmesg -c; done

and verified that

  kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak)

message appars everytime. This is unlikely temporary false positive.

  unreferenced object 0xdeb89408 (size 32):
    comm "insmod", pid 2969, jiffies 1406494

  unreferenced object 0xde842750 (size 32):
    comm "insmod", pid 2989, jiffies 1514442

  unreferenced object 0xde842a60 (size 32):
    comm "insmod", pid 2993, jiffies 1526889

  unreferenced object 0xdeb89440 (size 32):
    comm "insmod", pid 2999, jiffies 1539244

I'll wait for maintainer's response.

Thank you.

Re: [2.6.31] Memory leak in load_module()?

[Rusty Russell]

On Fri, 11 Sep 2009 05:08:46 pm Tetsuo Handa wrote:
> Is this real memory leak?

Yep.

God, this code is a turd.  This should fix it though:

diff --git a/kernel/module.c b/kernel/module.c
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1907,6 +1924,17 @@ static void setup_modinfo(struct module 
 	}
 }
 
+static void free_modinfo(struct module *mod)
+{
+	struct module_attribute *attr;
+	int i;
+
+	for (i = 0; (attr = modinfo_attrs[i]); i++) {
+		if (attr->free)
+			attr->free(mod);
+	}
+}
+
 #ifdef CONFIG_KALLSYMS
 
 /* lookup symbol in given range of kernel_symbols */
@@ -2632,6 +2662,7 @@ static noinline struct module *load_modu
 	synchronize_sched();
 	module_arch_cleanup(mod);
  cleanup:
+	free_modinfo(mod);
 	kobject_del(&mod->mkobj.kobj);
 	kobject_put(&mod->mkobj.kobj);
  free_unload:

Re: [2.6.31] Memory leak in load_module()?

[Tetsuo Handa]

Rusty Russell wrote:
> On Fri, 11 Sep 2009 05:08:46 pm Tetsuo Handa wrote:
> > Is this real memory leak?
> 
> Yep.
> 
> God, this code is a turd.  This should fix it though:

Yes. This patch solved the memory leak.

Thank you.