From nobody Fri Feb 13 09:34:11 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CF7C3E7F15A for ; Wed, 27 Sep 2023 03:43:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229538AbjI0Dm7 (ORCPT ); Tue, 26 Sep 2023 23:42:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41100 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229830AbjI0DkB (ORCPT ); Tue, 26 Sep 2023 23:40:01 -0400 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8E08C193 for ; Tue, 26 Sep 2023 20:06:11 -0700 (PDT) Received: from dggpemm500009.china.huawei.com (unknown [172.30.72.56]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4RwLx82PY8ztT3Y; Wed, 27 Sep 2023 11:01:48 +0800 (CST) Received: from huawei.com (10.175.113.32) by dggpemm500009.china.huawei.com (7.185.36.225) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.31; Wed, 27 Sep 2023 11:06:09 +0800 From: Liu Shixin To: Catalin Marinas , Patrick Wang , Andrew Morton CC: , , Liu Shixin Subject: [PATCH 1/3] bootmem: use kmemleak_free_part_phys in free_bootmem_page/put_page_bootmem Date: Wed, 27 Sep 2023 11:59:21 +0800 Message-ID: <20230927035923.1425340-2-liushixin2@huawei.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20230927035923.1425340-1-liushixin2@huawei.com> References: <20230927035923.1425340-1-liushixin2@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.175.113.32] X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To dggpemm500009.china.huawei.com (7.185.36.225) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Since kmemleak_alloc_phys() rather than kmemleak_alloc() was called from memblock_alloc_range_nid(), kmemleak_free_part_phys() should be used to delete kmemleak object in free_bootmem_page() and put_page_bootmem(). Fixes: 028725e73375 ("bootmem: remove the vmemmap pages from kmemleak in fr= ee_bootmem_page") Fixes: dd0ff4d12dd2 ("bootmem: remove the vmemmap pages from kmemleak in pu= t_page_bootmem") Signed-off-by: Liu Shixin Acked-by: Catalin Marinas --- include/linux/bootmem_info.h | 2 +- mm/bootmem_info.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/include/linux/bootmem_info.h b/include/linux/bootmem_info.h index e1a3c9c9754c..cffa38a73618 100644 --- a/include/linux/bootmem_info.h +++ b/include/linux/bootmem_info.h @@ -60,7 +60,7 @@ static inline void get_page_bootmem(unsigned long info, s= truct page *page, =20 static inline void free_bootmem_page(struct page *page) { - kmemleak_free_part(page_to_virt(page), PAGE_SIZE); + kmemleak_free_part_phys(PFN_PHYS(page_to_pfn(page)), PAGE_SIZE); free_reserved_page(page); } #endif diff --git a/mm/bootmem_info.c b/mm/bootmem_info.c index b1efebfcf94b..fa7cb0c87c03 100644 --- a/mm/bootmem_info.c +++ b/mm/bootmem_info.c @@ -34,7 +34,7 @@ void put_page_bootmem(struct page *page) ClearPagePrivate(page); set_page_private(page, 0); INIT_LIST_HEAD(&page->lru); - kmemleak_free_part(page_to_virt(page), PAGE_SIZE); + kmemleak_free_part_phys(PFN_PHYS(page_to_pfn(page)), PAGE_SIZE); free_reserved_page(page); } } --=20 2.25.1 From nobody Fri Feb 13 09:34:11 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82274E7F15A for ; Wed, 27 Sep 2023 03:43:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229598AbjI0DnS (ORCPT ); Tue, 26 Sep 2023 23:43:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41084 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229836AbjI0DkB (ORCPT ); Tue, 26 Sep 2023 23:40:01 -0400 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F22B72689 for ; Tue, 26 Sep 2023 20:06:11 -0700 (PDT) Received: from dggpemm500009.china.huawei.com (unknown [172.30.72.53]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4RwLzZ6TCkzrSnL; Wed, 27 Sep 2023 11:03:54 +0800 (CST) Received: from huawei.com (10.175.113.32) by dggpemm500009.china.huawei.com (7.185.36.225) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.31; Wed, 27 Sep 2023 11:06:10 +0800 From: Liu Shixin To: Catalin Marinas , Patrick Wang , Andrew Morton CC: , , Liu Shixin Subject: [PATCH 2/3] mm/kmemleak: fix partially freeing unknown object warning Date: Wed, 27 Sep 2023 11:59:22 +0800 Message-ID: <20230927035923.1425340-3-liushixin2@huawei.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20230927035923.1425340-1-liushixin2@huawei.com> References: <20230927035923.1425340-1-liushixin2@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.175.113.32] X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To dggpemm500009.china.huawei.com (7.185.36.225) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" delete_object_part() can be called by multiple callers in the same time. If an object is found and removed by a caller, and then another caller try to find it too, it failed and return directly. The secound part still be recorded by kmemleak even if it has alreadly been freed to buddy. With DEBUG on, kmemleak will report the following warning: kmemleak: Partially freeing unknown object at 0xa1af86000 (size 4096) CPU: 0 PID: 742 Comm: test_huge Not tainted 6.6.0-rc3kmemleak+ #54 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu= 1.1 04/01/2014 Call Trace: dump_stack_lvl+0x37/0x50 kmemleak_free_part_phys+0x50/0x60 hugetlb_vmemmap_optimize+0x172/0x290 ? __pfx_vmemmap_remap_pte+0x10/0x10 __prep_new_hugetlb_folio+0xe/0x30 prep_new_hugetlb_folio.isra.0+0xe/0x40 alloc_fresh_hugetlb_folio+0xc3/0xd0 alloc_surplus_hugetlb_folio.constprop.0+0x6e/0xd0 hugetlb_acct_memory.part.0+0xe6/0x2a0 hugetlb_reserve_pages+0x110/0x2c0 hugetlbfs_file_mmap+0x11d/0x1b0 mmap_region+0x248/0x9a0 ? hugetlb_get_unmapped_area+0x15c/0x2d0 do_mmap+0x38b/0x580 vm_mmap_pgoff+0xe6/0x190 ksys_mmap_pgoff+0x18a/0x1f0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Fixes: 53238a60dd4a ("kmemleak: Allow partial freeing of memory blocks") Signed-off-by: Liu Shixin --- mm/kmemleak.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/mm/kmemleak.c b/mm/kmemleak.c index 54c2c90d3abc..5a2bbd85df57 100644 --- a/mm/kmemleak.c +++ b/mm/kmemleak.c @@ -208,6 +208,8 @@ static struct rb_root object_tree_root =3D RB_ROOT; static struct rb_root object_phys_tree_root =3D RB_ROOT; /* protecting the access to object_list, object_tree_root (or object_phys_= tree_root) */ static DEFINE_RAW_SPINLOCK(kmemleak_lock); +/* Serial delete_object_part() to ensure all objects is deleted correctly = */ +static DEFINE_RAW_SPINLOCK(delete_object_part_mutex); =20 /* allocation caches for kmemleak internal data */ static struct kmem_cache *object_cache; @@ -784,13 +786,16 @@ static void delete_object_part(unsigned long ptr, siz= e_t size, bool is_phys) { struct kmemleak_object *object; unsigned long start, end; + unsigned long flags; =20 + raw_spin_lock_irqsave(&delete_object_part_mutex, flags); object =3D find_and_remove_object(ptr, 1, is_phys); if (!object) { #ifdef DEBUG kmemleak_warn("Partially freeing unknown object at 0x%08lx (size %zu)\n", ptr, size); #endif + raw_spin_unlock_irqrestore(&delete_object_part_mutex, flags); return; } =20 @@ -809,6 +814,7 @@ static void delete_object_part(unsigned long ptr, size_= t size, bool is_phys) GFP_KERNEL, is_phys); =20 __delete_object(object); + raw_spin_unlock_irqrestore(&delete_object_part_mutex, flags); } =20 static void __paint_it(struct kmemleak_object *object, int color) --=20 2.25.1 From nobody Fri Feb 13 09:34:11 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4C49EE7F15A for ; Wed, 27 Sep 2023 03:43:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229565AbjI0DnM (ORCPT ); Tue, 26 Sep 2023 23:43:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34342 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229831AbjI0DkB (ORCPT ); Tue, 26 Sep 2023 23:40:01 -0400 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AB404270B for ; Tue, 26 Sep 2023 20:06:12 -0700 (PDT) Received: from dggpemm500009.china.huawei.com (unknown [172.30.72.53]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4RwLxn1LJJzNnw3; Wed, 27 Sep 2023 11:02:21 +0800 (CST) Received: from huawei.com (10.175.113.32) by dggpemm500009.china.huawei.com (7.185.36.225) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.31; Wed, 27 Sep 2023 11:06:10 +0800 From: Liu Shixin To: Catalin Marinas , Patrick Wang , Andrew Morton CC: , , Liu Shixin Subject: [PATCH 3/3] mm/kmemleak: fix print format of pointer in pr_debug() Date: Wed, 27 Sep 2023 11:59:23 +0800 Message-ID: <20230927035923.1425340-4-liushixin2@huawei.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20230927035923.1425340-1-liushixin2@huawei.com> References: <20230927035923.1425340-1-liushixin2@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.175.113.32] X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To dggpemm500009.china.huawei.com (7.185.36.225) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" With 0x%p, the pointer will be hashed and print (____ptrval____) instead. And with 0x%pa, the pointer can be successfully printed but with duplicate prefixes, which looks like: kmemleak: kmemleak_free(0x(____ptrval____)) kmemleak: kmemleak_free_part_phys(0x0x0000000a1af86000) Use %pa instead of 0x%p or 0x%pa to print the pointer, and use 0x%px for __percpu pointer to prevent crash. Then the print will be like: kmemleak: kmemleak_free(0xffff9111c145b020) kmemleak: kmemleak_free_percpu(0x00000000000333b0) kmemleak: kmemleak_free_part_phys(0x0000000a1af80000) Signed-off-by: Liu Shixin --- mm/kmemleak.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/mm/kmemleak.c b/mm/kmemleak.c index 5a2bbd85df57..c1053db98f55 100644 --- a/mm/kmemleak.c +++ b/mm/kmemleak.c @@ -981,7 +981,7 @@ static void object_no_scan(unsigned long ptr) void __ref kmemleak_alloc(const void *ptr, size_t size, int min_count, gfp_t gfp) { - pr_debug("%s(0x%p, %zu, %d)\n", __func__, ptr, size, min_count); + pr_debug("%s(%pa, %zu, %d)\n", __func__, ptr, size, min_count); =20 if (kmemleak_enabled && ptr && !IS_ERR(ptr)) create_object((unsigned long)ptr, size, min_count, gfp); @@ -1002,7 +1002,7 @@ void __ref kmemleak_alloc_percpu(const void __percpu = *ptr, size_t size, { unsigned int cpu; =20 - pr_debug("%s(0x%p, %zu)\n", __func__, ptr, size); + pr_debug("%s(0x%px, %zu)\n", __func__, ptr, size); =20 /* * Percpu allocations are only scanned and not reported as leaks @@ -1026,7 +1026,7 @@ EXPORT_SYMBOL_GPL(kmemleak_alloc_percpu); */ void __ref kmemleak_vmalloc(const struct vm_struct *area, size_t size, gfp= _t gfp) { - pr_debug("%s(0x%p, %zu)\n", __func__, area, size); + pr_debug("%s(%pa, %zu)\n", __func__, area, size); =20 /* * A min_count =3D 2 is needed because vm_struct contains a reference to @@ -1049,7 +1049,7 @@ EXPORT_SYMBOL_GPL(kmemleak_vmalloc); */ void __ref kmemleak_free(const void *ptr) { - pr_debug("%s(0x%p)\n", __func__, ptr); + pr_debug("%s(%pa)\n", __func__, ptr); =20 if (kmemleak_free_enabled && ptr && !IS_ERR(ptr)) delete_object_full((unsigned long)ptr); @@ -1067,7 +1067,7 @@ EXPORT_SYMBOL_GPL(kmemleak_free); */ void __ref kmemleak_free_part(const void *ptr, size_t size) { - pr_debug("%s(0x%p)\n", __func__, ptr); + pr_debug("%s(%pa)\n", __func__, ptr); =20 if (kmemleak_enabled && ptr && !IS_ERR(ptr)) delete_object_part((unsigned long)ptr, size, false); @@ -1085,7 +1085,7 @@ void __ref kmemleak_free_percpu(const void __percpu *= ptr) { unsigned int cpu; =20 - pr_debug("%s(0x%p)\n", __func__, ptr); + pr_debug("%s(0x%px)\n", __func__, ptr); =20 if (kmemleak_free_enabled && ptr && !IS_ERR(ptr)) for_each_possible_cpu(cpu) @@ -1106,7 +1106,7 @@ void __ref kmemleak_update_trace(const void *ptr) struct kmemleak_object *object; unsigned long flags; =20 - pr_debug("%s(0x%p)\n", __func__, ptr); + pr_debug("%s(%pa)\n", __func__, ptr); =20 if (!kmemleak_enabled || IS_ERR_OR_NULL(ptr)) return; @@ -1137,7 +1137,7 @@ EXPORT_SYMBOL(kmemleak_update_trace); */ void __ref kmemleak_not_leak(const void *ptr) { - pr_debug("%s(0x%p)\n", __func__, ptr); + pr_debug("%s(%pa)\n", __func__, ptr); =20 if (kmemleak_enabled && ptr && !IS_ERR(ptr)) make_gray_object((unsigned long)ptr); @@ -1155,7 +1155,7 @@ EXPORT_SYMBOL(kmemleak_not_leak); */ void __ref kmemleak_ignore(const void *ptr) { - pr_debug("%s(0x%p)\n", __func__, ptr); + pr_debug("%s(%pa)\n", __func__, ptr) ; =20 if (kmemleak_enabled && ptr && !IS_ERR(ptr)) make_black_object((unsigned long)ptr, false); @@ -1175,7 +1175,7 @@ EXPORT_SYMBOL(kmemleak_ignore); */ void __ref kmemleak_scan_area(const void *ptr, size_t size, gfp_t gfp) { - pr_debug("%s(0x%p)\n", __func__, ptr); + pr_debug("%s(%pa)\n", __func__, ptr); =20 if (kmemleak_enabled && ptr && size && !IS_ERR(ptr)) add_scan_area((unsigned long)ptr, size, gfp); @@ -1193,7 +1193,7 @@ EXPORT_SYMBOL(kmemleak_scan_area); */ void __ref kmemleak_no_scan(const void *ptr) { - pr_debug("%s(0x%p)\n", __func__, ptr); + pr_debug("%s(%pa)\n", __func__, ptr); =20 if (kmemleak_enabled && ptr && !IS_ERR(ptr)) object_no_scan((unsigned long)ptr); @@ -1209,7 +1209,7 @@ EXPORT_SYMBOL(kmemleak_no_scan); */ void __ref kmemleak_alloc_phys(phys_addr_t phys, size_t size, gfp_t gfp) { - pr_debug("%s(0x%pa, %zu)\n", __func__, &phys, size); + pr_debug("%s(%pa, %zu)\n", __func__, &phys, size); =20 if (kmemleak_enabled) /* @@ -1229,7 +1229,7 @@ EXPORT_SYMBOL(kmemleak_alloc_phys); */ void __ref kmemleak_free_part_phys(phys_addr_t phys, size_t size) { - pr_debug("%s(0x%pa)\n", __func__, &phys); + pr_debug("%s(%pa)\n", __func__, &phys); =20 if (kmemleak_enabled) delete_object_part((unsigned long)phys, size, true); @@ -1243,7 +1243,7 @@ EXPORT_SYMBOL(kmemleak_free_part_phys); */ void __ref kmemleak_ignore_phys(phys_addr_t phys) { - pr_debug("%s(0x%pa)\n", __func__, &phys); + pr_debug("%s(%pa)\n", __func__, &phys); =20 if (kmemleak_enabled) make_black_object((unsigned long)phys, true); --=20 2.25.1