[PATCH v2 0/3] mm: kmemleak: default min_unref_scans to 2 for verbose kernels

[PATCH v2 0/3] mm: kmemleak: default min_unref_scans to 2 for verbose kernels

[Breno Leitao]

When CONFIG_DEBUG_KMEMLEAK_VERBOSE is set, which means the host is in
auto scan mode, set min_unref_scans to 2, avoiding false positives.

CONFIG_DEBUG_KMEMLEAK_VERBOSE depends on CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN,
so a kernel built with it already runs the scan thread periodically and
the user has asked for detailed leak reports.

The confirming second scan comes for free there, so default
min_unref_scans to 2 in that case and keep it at 1 everywhere else.
CONFIG_DEBUG_KMEMLEAK_VERBOSE defaults to n, so nothing changes for
kernels that do not opt in.

The other two patches bring the documentation and the selftest comments
in line with the new conditional default.

PS: A similar patch (v1 of this patchset) is applied to Meta's kernel,
in real production hosts.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
Changes in v2:
- Test only CONFIG_DEBUG_KMEMLEAK_VERBOSE, which already depends on
  CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN; the #if block becomes a plain
  IS_ENABLED() initializer
- Note in the changelog that CONFIG_DEBUG_KMEMLEAK_VERBOSE defaults to n
- New patch: update Documentation/dev-tools/kmemleak.rst, which still
  documented the default as unconditionally 1
- New patch: drop the stale "default" wording from the
  ksft_kmemleak_confirm.sh comments
- Link to v1: https://patch.msgid.link/20260730-kmemleak_hardened-v1-1-b0b20033b4bb@debian.org

To: Catalin Marinas <catalin.marinas@arm.com>
To: Andrew Morton <akpm@linux-foundation.org>
To: Jonathan Corbet <corbet@lwn.net>
To: Shuah Khan <skhan@linuxfoundation.org>
To: David Hildenbrand <david@kernel.org>
To: Lorenzo Stoakes <ljs@kernel.org>
To: "Liam R. Howlett" <liam@infradead.org>
To: Vlastimil Babka <vbabka@kernel.org>
To: Mike Rapoport <rppt@kernel.org>
To: Suren Baghdasaryan <surenb@google.com>
To: Michal Hocko <mhocko@suse.com>
To: Shuah Khan <shuah@kernel.org>
Cc: linux-mm@kvack.org
Cc: linux-kernel@vger.kernel.org
Cc: workflows@vger.kernel.org
Cc: linux-doc@vger.kernel.org
Cc: linux-kselftest@vger.kernel.org

---
Breno Leitao (3):
      mm: kmemleak: default min_unref_scans to 2 for verbose auto-scan
      Documentation: kmemleak: document the conditional min_unref_scans default
      selftests/mm: kmemleak: drop stale min_unref_scans default from comments

 Documentation/dev-tools/kmemleak.rst                | 12 +++++++-----
 mm/kmemleak.c                                       |  3 ++-
 tools/testing/selftests/mm/ksft_kmemleak_confirm.sh | 10 ++++------
 3 files changed, 13 insertions(+), 12 deletions(-)
---
base-commit: 78bc8af4affb9a732504eb22eeac7d1e50883853
change-id: 20260730-kmemleak_hardened-e80542d1152f

Best regards,
--  
Breno Leitao <leitao@debian.org>

[PATCH v2 1/3] mm: kmemleak: default min_unref_scans to 2 for verbose auto-scan

[Breno Leitao]

min_unref_scans defers reporting an object as leaked until it has stayed
unreferenced for that many consecutive scans, filtering out objects that
are only transiently unreferenced during a scan.

It defaults to 1, which reports on the first unreferenced scan.

CONFIG_DEBUG_KMEMLEAK_VERBOSE depends on CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN,
so a kernel built with it runs the scan thread periodically and the user
has opted into detailed leak reporting. A second confirming scan then
happens on its own.

Default min_unref_scans to 2 there to suppress transient false positives,
and keep it at 1 otherwise, where a manually triggered scan is expected to
report immediately. The value stays writable through the module parameter.

CONFIG_DEBUG_KMEMLEAK_VERBOSE defaults to n, so this does not change the
default for kernels that do not opt in.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
 mm/kmemleak.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index f63dfacee7ca1..8fa409a4f9fb2 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -237,7 +237,8 @@ static struct task_struct *scan_thread;
 /* used to avoid reporting of recently allocated objects */
 static unsigned long jiffies_min_age;
 /* consecutive scans an object must stay unreferenced before reporting */
-static unsigned int min_unref_scans = 1;
+static unsigned int min_unref_scans =
+	IS_ENABLED(CONFIG_DEBUG_KMEMLEAK_VERBOSE) ? 2 : 1;
 module_param(min_unref_scans, uint, 0644);
 static unsigned long jiffies_last_scan;
 /* delay between automatic memory scannings */

-- 
2.53.0-Meta

[PATCH v2 2/3] Documentation: kmemleak: document the conditional min_unref_scans default

[Breno Leitao]

min_unref_scans now defaults to 2 when CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN and
CONFIG_DEBUG_KMEMLEAK_VERBOSE are both enabled, but the documentation still
states that the default is unconditionally 1.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
 Documentation/dev-tools/kmemleak.rst | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/Documentation/dev-tools/kmemleak.rst b/Documentation/dev-tools/kmemleak.rst
index a8a83bc69ceb8..d1b690b171696 100644
--- a/Documentation/dev-tools/kmemleak.rst
+++ b/Documentation/dev-tools/kmemleak.rst
@@ -198,11 +198,13 @@ systems, because of pointers temporarily stored in CPU registers or
 stacks. Kmemleak defines MSECS_MIN_AGE (defaulting to 1000) representing
 the minimum age of an object to be reported as a memory leak.
 
-The ``min_unref_scans`` module parameter (default 1) requires an object to
-be seen unreferenced in that many consecutive scans before it is reported.
-Keeping it at 1 preserves the historical behaviour; higher values filter
-the transient false positives described above, at the cost of delaying
-genuine reports by up to that many scans. It can be set at boot with
+The ``min_unref_scans`` module parameter requires an object to be seen
+unreferenced in that many consecutive scans before it is reported. It
+defaults to 2 when CONFIG_DEBUG_KMEMLEAK_VERBOSE is enabled, where the
+periodic scan thread confirms a leak on its own, and to 1 otherwise. A
+value of 1 preserves the historical behaviour; higher values filter the
+transient false positives described above, at the cost of delaying genuine
+reports by up to that many scans. It can be set at boot with
 ``kmemleak.min_unref_scans=<n>`` or at run-time via
 ``/sys/module/kmemleak/parameters/min_unref_scans``.
 

-- 
2.53.0-Meta

[PATCH v2 3/3] selftests/mm: kmemleak: drop stale min_unref_scans default from comments

[Breno Leitao]

The test writes min_unref_scans explicitly for every case, so its comments
describing 1 as the default are both unnecessary and, since the default is
now conditional, wrong. Refer to the threshold values directly.

No functional change.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
 tools/testing/selftests/mm/ksft_kmemleak_confirm.sh | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/tools/testing/selftests/mm/ksft_kmemleak_confirm.sh b/tools/testing/selftests/mm/ksft_kmemleak_confirm.sh
index 3a8576e835c8d..72ded5e6794c9 100755
--- a/tools/testing/selftests/mm/ksft_kmemleak_confirm.sh
+++ b/tools/testing/selftests/mm/ksft_kmemleak_confirm.sh
@@ -5,7 +5,7 @@
 # (the min_unref_scans module parameter).
 #
 # kmemleak only reports an object once it has stayed unreferenced for
-# min_unref_scans consecutive scans. The default of 1 reports on the first
+# min_unref_scans consecutive scans. A threshold of 1 reports on the first
 # scan (historical behaviour); higher values filter transient false
 # positives where a live object's only reference is briefly invisible to a
 # single scan (e.g. an RCU tree update in flight while the scan runs). The
@@ -16,8 +16,7 @@
 #   - a freshly allocated object is greyed on its first scan (its checksum
 #     settles then), so nothing can be reported before that priming scan;
 #     each case below primes once first,
-#   - with the default threshold (min_unref_scans=1) one scan after priming
-#     reports the orphans,
+#   - at min_unref_scans=1 one scan after priming reports the orphans,
 #   - raising the threshold to 2 needs two scans after priming: one is not
 #     enough, the second reports,
 #   - the parameter reads back what was written.
@@ -105,9 +104,8 @@ echo 3 > "$PARAM"
 # scan. Every case below runs this priming scan before counting.
 prime() { scan; }
 
-# 1) min_unref_scans=1 (default): one scan after priming reports the
-#    orphans. This also establishes that the helper produces detectable
-#    orphans here.
+# 1) min_unref_scans=1: one scan after priming reports the orphans. This
+#    also establishes that the helper produces detectable orphans here.
 echo 1 > "$PARAM"
 gen_orphans
 prime

-- 
2.53.0-Meta

Re: [PATCH v2 1/3] mm: kmemleak: default min_unref_scans to 2 for verbose auto-scan

[Catalin Marinas]

On Fri, Jul 31, 2026 at 03:13:04AM -0700, Breno Leitao wrote:
> min_unref_scans defers reporting an object as leaked until it has stayed
> unreferenced for that many consecutive scans, filtering out objects that
> are only transiently unreferenced during a scan.
> 
> It defaults to 1, which reports on the first unreferenced scan.
> 
> CONFIG_DEBUG_KMEMLEAK_VERBOSE depends on CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN,
> so a kernel built with it runs the scan thread periodically and the user
> has opted into detailed leak reporting. A second confirming scan then
> happens on its own.
> 
> Default min_unref_scans to 2 there to suppress transient false positives,
> and keep it at 1 otherwise, where a manually triggered scan is expected to
> report immediately. The value stays writable through the module parameter.
> 
> CONFIG_DEBUG_KMEMLEAK_VERBOSE defaults to n, so this does not change the
> default for kernels that do not opt in.
> 
> Signed-off-by: Breno Leitao <leitao@debian.org>

Acked-by: Catalin Marinas <catalin.marinas@arm.com>

Re: [PATCH v2 2/3] Documentation: kmemleak: document the conditional min_unref_scans default

[Catalin Marinas]

On Fri, Jul 31, 2026 at 03:13:05AM -0700, Breno Leitao wrote:
> min_unref_scans now defaults to 2 when CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN and
> CONFIG_DEBUG_KMEMLEAK_VERBOSE are both enabled, but the documentation still
> states that the default is unconditionally 1.
> 
> Signed-off-by: Breno Leitao <leitao@debian.org>

Acked-by: Catalin Marinas <catalin.marinas@arm.com>

Re: [PATCH v2 3/3] selftests/mm: kmemleak: drop stale min_unref_scans default from comments

[Catalin Marinas]

On Fri, Jul 31, 2026 at 03:13:06AM -0700, Breno Leitao wrote:
> The test writes min_unref_scans explicitly for every case, so its comments
> describing 1 as the default are both unnecessary and, since the default is
> now conditional, wrong. Refer to the threshold values directly.
> 
> No functional change.
> 
> Signed-off-by: Breno Leitao <leitao@debian.org>

Acked-by: Catalin Marinas <catalin.marinas@arm.com>