google / kernel-sanitizers

Linux Kernel Sanitizers, fast bug-detectors for the Linux kernel
https://google.github.io/kernel-sanitizers/
436 stars 87 forks source link

kfence: Debug memcg issues #164

Closed melver closed 3 years ago

melver commented 3 years ago

Currently it seems that KFENCE has problems with memcg allocations. To reproduce,

CONFIG_MEMCG=y
CONFIG_MEMCG_SWAP=y
CONFIG_MEMCG_KMEM=y

Then use tools/testing/selftests/cgroup/test_kmem to test. (Hint: boot with cgroup_no_v1=all on old distros, then mount -t cgroup2 none /sys/fs/cgroup).

For example (with SLAB):

general protection fault, probably for non-canonical address 0x6aba3f0293b07967: 0000 [#1] PREEMPT SMP PTI
CPU: 2 PID: 469 Comm: test_kmem Not tainted 5.9.0-rc4+ #10
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1 04/01/2014
RIP: 0010:obj_cgroup_memcg include/linux/memcontrol.h:526 [inline]
RIP: 0010:mem_cgroup_from_obj+0x68/0x80 mm/memcontrol.c:2902
Code: 49 83 e0 fe 89 d8 8b 4a 18 48 0f af c1 0f b6 4a 1c 48 c1 e8 20 29 c3 d3 eb 0f b6 4a 1d 01 c3 d3 eb 4d 8b 04 d8 4d 85 c0 74 04 <4d> 8b 40 38 4c 89 c0 5b c3 45 31 c0 4c 89 c0 c3 0f 1f 84 00 00 00
RSP: 0018:ffffaada00267b80 EFLAGS: 00010202
RAX: 0000000008492ad5 RBX: 00000000002124ab RCX: 0000000000000007
RDX: ffff96b917965cc0 RSI: ffff96b918db8080 RDI: 0000000080000000
RBP: ffff96b914996c80 R08: 6aba3f0293b07967 R09: ffffaada00267ae0
R10: 000000000002cbb8 R11: 0000000000000005 R12: ffff96b915345a40
R13: 0000000000000000 R14: ffff96b915345a48 R15: ffff96b9166249c0
FS:  00007fd34d3ca700(0000) GS:ffff96b91fc80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd34cccf280 CR3: 0000000816674003 CR4: 0000000000770ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 list_lru_from_kmem mm/list_lru.c:70 [inline]
 list_lru_add+0x9a/0x160 mm/list_lru.c:124
 d_lru_add+0x5a/0x80 fs/dcache.c:404
 retain_dentry fs/dcache.c:657 [inline]
 dput+0x22d/0x4f0 fs/dcache.c:873
 handle_mounts fs/namei.c:1389 [inline]
 step_into+0x481/0x910 fs/namei.c:1690
 walk_component+0x8c/0x220 fs/namei.c:1866
 lookup_last fs/namei.c:2309 [inline]
 path_lookupat+0x96/0x260 fs/namei.c:2333
 filename_lookup+0xc7/0x230 fs/namei.c:2366
 user_path_at include/linux/namei.h:59 [inline]
 vfs_statx+0x9e/0x180 fs/stat.c:202
 vfs_stat include/linux/fs.h:3173 [inline]
 __do_sys_newstat+0x43/0x90 fs/stat.c:361
 do_syscall_64+0x34/0x50 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fd34cccf295
Code: 00 00 00 e8 5d 01 00 00 48 83 c4 18 c3 0f 1f 84 00 00 00 00 00 83 ff 01 48 89 f0 77 30 48 89 c7 48 89 d6 b8 04 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 03 f3 c3 90 48 8b 15 d1 db 2b 00 f7 d8 64 89
RSP: 002b:00007ffdec501068 EFLAGS: 00000246 ORIG_RAX: 0000000000000004
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd34cccf295
RDX: 00007ffdec501100 RSI: 00007ffdec501100 RDI: 00007ffdec501080
RBP: 00007ffdec5011a0 R08: 0000000000000001 R09: 000000000000006d
R10: 0000000000000064 R11: 0000000000000246 R12: 00005570e96752b0
R13: 00007ffdec502380 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 070196d0f3b828d6 ]---