blob: 086292f7c59d1a69881068758150c2140feb8253 [file] [log] [blame]
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001/*
2 * mm/kmemleak.c
3 *
4 * Copyright (C) 2008 ARM Limited
5 * Written by Catalin Marinas <catalin.marinas@arm.com>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
19 *
20 *
21 * For more information on the algorithm and kmemleak usage, please see
22 * Documentation/kmemleak.txt.
23 *
24 * Notes on locking
25 * ----------------
26 *
27 * The following locks and mutexes are used by kmemleak:
28 *
29 * - kmemleak_lock (rwlock): protects the object_list modifications and
30 * accesses to the object_tree_root. The object_list is the main list
31 * holding the metadata (struct kmemleak_object) for the allocated memory
Michel Lespinasse85d3a312012-10-08 16:31:27 -070032 * blocks. The object_tree_root is a red black tree used to look-up
Catalin Marinas3c7b4e62009-06-11 13:22:39 +010033 * metadata based on a pointer to the corresponding memory block. The
34 * kmemleak_object structures are added to the object_list and
35 * object_tree_root in the create_object() function called from the
36 * kmemleak_alloc() callback and removed in delete_object() called from the
37 * kmemleak_free() callback
38 * - kmemleak_object.lock (spinlock): protects a kmemleak_object. Accesses to
39 * the metadata (e.g. count) are protected by this lock. Note that some
40 * members of this structure may be protected by other means (atomic or
41 * kmemleak_lock). This lock is also held when scanning the corresponding
42 * memory block to avoid the kernel freeing it via the kmemleak_free()
43 * callback. This is less heavyweight than holding a global lock like
44 * kmemleak_lock during scanning
45 * - scan_mutex (mutex): ensures that only one thread may scan the memory for
46 * unreferenced objects at a time. The gray_list contains the objects which
47 * are already referenced or marked as false positives and need to be
48 * scanned. This list is only modified during a scanning episode when the
49 * scan_mutex is held. At the end of a scan, the gray_list is always empty.
50 * Note that the kmemleak_object.use_count is incremented when an object is
Catalin Marinas4698c1f2009-06-26 17:38:27 +010051 * added to the gray_list and therefore cannot be freed. This mutex also
52 * prevents multiple users of the "kmemleak" debugfs file together with
53 * modifications to the memory scanning parameters including the scan_thread
54 * pointer
Catalin Marinas3c7b4e62009-06-11 13:22:39 +010055 *
Catalin Marinas93ada572015-06-24 16:58:37 -070056 * Locks and mutexes are acquired/nested in the following order:
Catalin Marinas9d5a4c72015-06-24 16:58:34 -070057 *
Catalin Marinas93ada572015-06-24 16:58:37 -070058 * scan_mutex [-> object->lock] -> kmemleak_lock -> other_object->lock (SINGLE_DEPTH_NESTING)
59 *
60 * No kmemleak_lock and object->lock nesting is allowed outside scan_mutex
61 * regions.
Catalin Marinas9d5a4c72015-06-24 16:58:34 -070062 *
Catalin Marinas3c7b4e62009-06-11 13:22:39 +010063 * The kmemleak_object structures have a use_count incremented or decremented
64 * using the get_object()/put_object() functions. When the use_count becomes
65 * 0, this count can no longer be incremented and put_object() schedules the
66 * kmemleak_object freeing via an RCU callback. All calls to the get_object()
67 * function must be protected by rcu_read_lock() to avoid accessing a freed
68 * structure.
69 */
70
Joe Perchesae281062009-06-23 14:40:26 +010071#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
72
Catalin Marinas3c7b4e62009-06-11 13:22:39 +010073#include <linux/init.h>
74#include <linux/kernel.h>
75#include <linux/list.h>
76#include <linux/sched.h>
77#include <linux/jiffies.h>
78#include <linux/delay.h>
Paul Gortmakerb95f1b312011-10-16 02:01:52 -040079#include <linux/export.h>
Catalin Marinas3c7b4e62009-06-11 13:22:39 +010080#include <linux/kthread.h>
Michel Lespinasse85d3a312012-10-08 16:31:27 -070081#include <linux/rbtree.h>
Catalin Marinas3c7b4e62009-06-11 13:22:39 +010082#include <linux/fs.h>
83#include <linux/debugfs.h>
84#include <linux/seq_file.h>
85#include <linux/cpumask.h>
86#include <linux/spinlock.h>
87#include <linux/mutex.h>
88#include <linux/rcupdate.h>
89#include <linux/stacktrace.h>
90#include <linux/cache.h>
91#include <linux/percpu.h>
92#include <linux/hardirq.h>
93#include <linux/mmzone.h>
94#include <linux/slab.h>
95#include <linux/thread_info.h>
96#include <linux/err.h>
97#include <linux/uaccess.h>
98#include <linux/string.h>
99#include <linux/nodemask.h>
100#include <linux/mm.h>
Catalin Marinas179a8102009-09-07 10:14:42 +0100101#include <linux/workqueue.h>
Catalin Marinas04609ccc2009-10-28 13:33:12 +0000102#include <linux/crc32.h>
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100103
104#include <asm/sections.h>
105#include <asm/processor.h>
Arun Sharma600634972011-07-26 16:09:06 -0700106#include <linux/atomic.h>
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100107
Andrey Ryabinine79ed2f2015-02-13 14:39:49 -0800108#include <linux/kasan.h>
Pekka Enberg8e019362009-08-27 14:50:00 +0100109#include <linux/kmemcheck.h>
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100110#include <linux/kmemleak.h>
Laura Abbott029aeff2011-11-15 23:49:09 +0000111#include <linux/memory_hotplug.h>
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100112
113/*
114 * Kmemleak configuration and common defines.
115 */
116#define MAX_TRACE 16 /* stack trace length */
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100117#define MSECS_MIN_AGE 5000 /* minimum object age for reporting */
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100118#define SECS_FIRST_SCAN 60 /* delay before the first scan */
119#define SECS_SCAN_WAIT 600 /* subsequent auto scanning delay */
Catalin Marinasaf986032009-08-27 14:29:12 +0100120#define MAX_SCAN_SIZE 4096 /* maximum size of a scanned block */
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100121
122#define BYTES_PER_POINTER sizeof(void *)
123
Catalin Marinas216c04b2009-06-17 18:29:02 +0100124/* GFP bitmask for kmemleak internal allocations */
Vladimir Davydov20b5c302016-01-14 15:18:08 -0800125#define gfp_kmemleak_mask(gfp) (((gfp) & (GFP_KERNEL | GFP_ATOMIC)) | \
Catalin Marinas6ae4bd12011-01-27 10:30:26 +0000126 __GFP_NORETRY | __GFP_NOMEMALLOC | \
127 __GFP_NOWARN)
Catalin Marinas216c04b2009-06-17 18:29:02 +0100128
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100129/* scanning area inside a memory block */
130struct kmemleak_scan_area {
131 struct hlist_node node;
Catalin Marinasc017b4b2009-10-28 13:33:09 +0000132 unsigned long start;
133 size_t size;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100134};
135
Luis R. Rodrigueza1084c82009-09-04 17:44:52 -0700136#define KMEMLEAK_GREY 0
137#define KMEMLEAK_BLACK -1
138
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100139/*
140 * Structure holding the metadata for each allocated memory block.
141 * Modifications to such objects should be made while holding the
142 * object->lock. Insertions or deletions from object_list, gray_list or
Michel Lespinasse85d3a312012-10-08 16:31:27 -0700143 * rb_node are already protected by the corresponding locks or mutex (see
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100144 * the notes on locking above). These objects are reference-counted
145 * (use_count) and freed using the RCU mechanism.
146 */
147struct kmemleak_object {
148 spinlock_t lock;
149 unsigned long flags; /* object status flags */
150 struct list_head object_list;
151 struct list_head gray_list;
Michel Lespinasse85d3a312012-10-08 16:31:27 -0700152 struct rb_node rb_node;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100153 struct rcu_head rcu; /* object_list lockless traversal */
154 /* object usage count; object freed when use_count == 0 */
155 atomic_t use_count;
156 unsigned long pointer;
157 size_t size;
158 /* minimum number of a pointers found before it is considered leak */
159 int min_count;
160 /* the total number of pointers found pointing to this object */
161 int count;
Catalin Marinas04609ccc2009-10-28 13:33:12 +0000162 /* checksum for detecting modified objects */
163 u32 checksum;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100164 /* memory ranges to be scanned inside an object (empty for all) */
165 struct hlist_head area_list;
166 unsigned long trace[MAX_TRACE];
167 unsigned int trace_len;
168 unsigned long jiffies; /* creation timestamp */
169 pid_t pid; /* pid of the current task */
170 char comm[TASK_COMM_LEN]; /* executable name */
171};
172
173/* flag representing the memory block allocation status */
174#define OBJECT_ALLOCATED (1 << 0)
175/* flag set after the first reporting of an unreference object */
176#define OBJECT_REPORTED (1 << 1)
177/* flag set to not scan the object */
178#define OBJECT_NO_SCAN (1 << 2)
179
Sergey Senozhatsky0494e082009-08-27 14:29:18 +0100180/* number of bytes to print per line; must be 16 or 32 */
181#define HEX_ROW_SIZE 16
182/* number of bytes to print at a time (1, 2, 4, 8) */
183#define HEX_GROUP_SIZE 1
184/* include ASCII after the hex output */
185#define HEX_ASCII 1
186/* max number of lines to be printed */
187#define HEX_MAX_LINES 2
188
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100189/* the list of all allocated objects */
190static LIST_HEAD(object_list);
191/* the list of gray-colored objects (see color_gray comment below) */
192static LIST_HEAD(gray_list);
Michel Lespinasse85d3a312012-10-08 16:31:27 -0700193/* search tree for object boundaries */
194static struct rb_root object_tree_root = RB_ROOT;
195/* rw_lock protecting the access to object_list and object_tree_root */
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100196static DEFINE_RWLOCK(kmemleak_lock);
197
198/* allocation caches for kmemleak internal data */
199static struct kmem_cache *object_cache;
200static struct kmem_cache *scan_area_cache;
201
202/* set if tracing memory operations is enabled */
Li Zefan8910ae82014-04-03 14:46:29 -0700203static int kmemleak_enabled;
Catalin Marinasc5f3b1a2015-06-24 16:58:26 -0700204/* same as above but only for the kmemleak_free() callback */
205static int kmemleak_free_enabled;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100206/* set in the late_initcall if there were no errors */
Li Zefan8910ae82014-04-03 14:46:29 -0700207static int kmemleak_initialized;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100208/* enables or disables early logging of the memory operations */
Li Zefan8910ae82014-04-03 14:46:29 -0700209static int kmemleak_early_log = 1;
Catalin Marinas5f790202011-09-28 12:17:03 +0100210/* set if a kmemleak warning was issued */
Li Zefan8910ae82014-04-03 14:46:29 -0700211static int kmemleak_warning;
Catalin Marinas5f790202011-09-28 12:17:03 +0100212/* set if a fatal kmemleak error has occurred */
Li Zefan8910ae82014-04-03 14:46:29 -0700213static int kmemleak_error;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100214
215/* minimum and maximum address that may be valid pointers */
216static unsigned long min_addr = ULONG_MAX;
217static unsigned long max_addr;
218
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100219static struct task_struct *scan_thread;
Catalin Marinasacf49682009-06-26 17:38:29 +0100220/* used to avoid reporting of recently allocated objects */
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100221static unsigned long jiffies_min_age;
Catalin Marinasacf49682009-06-26 17:38:29 +0100222static unsigned long jiffies_last_scan;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100223/* delay between automatic memory scannings */
224static signed long jiffies_scan_wait;
225/* enables or disables the task stacks scanning */
Catalin Marinase0a2a162009-06-26 17:38:25 +0100226static int kmemleak_stack_scan = 1;
Catalin Marinas4698c1f2009-06-26 17:38:27 +0100227/* protects the memory scanning, parameters and debug/kmemleak file access */
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100228static DEFINE_MUTEX(scan_mutex);
Jason Baronab0155a2010-07-19 11:54:17 +0100229/* setting kmemleak=on, will set this var, skipping the disable */
230static int kmemleak_skip_disable;
Li Zefandc9b3f42014-04-03 14:46:26 -0700231/* If there are leaks that can be reported */
232static bool kmemleak_found_leaks;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100233
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100234/*
Catalin Marinas20301172009-06-17 18:29:04 +0100235 * Early object allocation/freeing logging. Kmemleak is initialized after the
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100236 * kernel allocator. However, both the kernel allocator and kmemleak may
Catalin Marinas20301172009-06-17 18:29:04 +0100237 * allocate memory blocks which need to be tracked. Kmemleak defines an
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100238 * arbitrary buffer to hold the allocation/freeing information before it is
239 * fully initialized.
240 */
241
242/* kmemleak operation type for early logging */
243enum {
244 KMEMLEAK_ALLOC,
Catalin Marinasf528f0b2011-09-26 17:12:53 +0100245 KMEMLEAK_ALLOC_PERCPU,
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100246 KMEMLEAK_FREE,
Catalin Marinas53238a62009-07-07 10:33:00 +0100247 KMEMLEAK_FREE_PART,
Catalin Marinasf528f0b2011-09-26 17:12:53 +0100248 KMEMLEAK_FREE_PERCPU,
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100249 KMEMLEAK_NOT_LEAK,
250 KMEMLEAK_IGNORE,
251 KMEMLEAK_SCAN_AREA,
252 KMEMLEAK_NO_SCAN
253};
254
255/*
256 * Structure holding the information passed to kmemleak callbacks during the
257 * early logging.
258 */
259struct early_log {
260 int op_type; /* kmemleak operation type */
261 const void *ptr; /* allocated/freed memory block */
262 size_t size; /* memory block size */
263 int min_count; /* minimum reference count */
Catalin Marinasfd678962009-08-27 14:29:17 +0100264 unsigned long trace[MAX_TRACE]; /* stack trace */
265 unsigned int trace_len; /* stack trace length */
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100266};
267
268/* early logging buffer and current position */
Catalin Marinasa6186d82009-08-27 14:29:16 +0100269static struct early_log
270 early_log[CONFIG_DEBUG_KMEMLEAK_EARLY_LOG_SIZE] __initdata;
271static int crt_early_log __initdata;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100272
273static void kmemleak_disable(void);
274
275/*
276 * Print a warning and dump the stack trace.
277 */
Catalin Marinas5f790202011-09-28 12:17:03 +0100278#define kmemleak_warn(x...) do { \
Joe Perches598d8092016-03-17 14:19:44 -0700279 pr_warn(x); \
Catalin Marinas5f790202011-09-28 12:17:03 +0100280 dump_stack(); \
Li Zefan8910ae82014-04-03 14:46:29 -0700281 kmemleak_warning = 1; \
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100282} while (0)
283
284/*
Lucas De Marchi25985ed2011-03-30 22:57:33 -0300285 * Macro invoked when a serious kmemleak condition occurred and cannot be
Catalin Marinas20301172009-06-17 18:29:04 +0100286 * recovered from. Kmemleak will be disabled and further allocation/freeing
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100287 * tracing no longer available.
288 */
Catalin Marinas000814f2009-06-17 18:29:03 +0100289#define kmemleak_stop(x...) do { \
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100290 kmemleak_warn(x); \
291 kmemleak_disable(); \
292} while (0)
293
294/*
Sergey Senozhatsky0494e082009-08-27 14:29:18 +0100295 * Printing of the objects hex dump to the seq file. The number of lines to be
296 * printed is limited to HEX_MAX_LINES to prevent seq file spamming. The
297 * actual number of printed bytes depends on HEX_ROW_SIZE. It must be called
298 * with the object->lock held.
299 */
300static void hex_dump_object(struct seq_file *seq,
301 struct kmemleak_object *object)
302{
303 const u8 *ptr = (const u8 *)object->pointer;
Andy Shevchenko6fc37c42015-09-09 15:38:45 -0700304 size_t len;
Sergey Senozhatsky0494e082009-08-27 14:29:18 +0100305
306 /* limit the number of lines to HEX_MAX_LINES */
Andy Shevchenko6fc37c42015-09-09 15:38:45 -0700307 len = min_t(size_t, object->size, HEX_MAX_LINES * HEX_ROW_SIZE);
Sergey Senozhatsky0494e082009-08-27 14:29:18 +0100308
Andy Shevchenko6fc37c42015-09-09 15:38:45 -0700309 seq_printf(seq, " hex dump (first %zu bytes):\n", len);
Dmitry Vyukov5c335fe2016-06-24 14:50:07 -0700310 kasan_disable_current();
Andy Shevchenko6fc37c42015-09-09 15:38:45 -0700311 seq_hex_dump(seq, " ", DUMP_PREFIX_NONE, HEX_ROW_SIZE,
312 HEX_GROUP_SIZE, ptr, len, HEX_ASCII);
Dmitry Vyukov5c335fe2016-06-24 14:50:07 -0700313 kasan_enable_current();
Sergey Senozhatsky0494e082009-08-27 14:29:18 +0100314}
315
316/*
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100317 * Object colors, encoded with count and min_count:
318 * - white - orphan object, not enough references to it (count < min_count)
319 * - gray - not orphan, not marked as false positive (min_count == 0) or
320 * sufficient references to it (count >= min_count)
321 * - black - ignore, it doesn't contain references (e.g. text section)
322 * (min_count == -1). No function defined for this color.
323 * Newly created objects don't have any color assigned (object->count == -1)
324 * before the next memory scan when they become white.
325 */
Luis R. Rodriguez4a558dd2009-09-08 16:34:50 +0100326static bool color_white(const struct kmemleak_object *object)
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100327{
Luis R. Rodrigueza1084c82009-09-04 17:44:52 -0700328 return object->count != KMEMLEAK_BLACK &&
329 object->count < object->min_count;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100330}
331
Luis R. Rodriguez4a558dd2009-09-08 16:34:50 +0100332static bool color_gray(const struct kmemleak_object *object)
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100333{
Luis R. Rodrigueza1084c82009-09-04 17:44:52 -0700334 return object->min_count != KMEMLEAK_BLACK &&
335 object->count >= object->min_count;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100336}
337
338/*
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100339 * Objects are considered unreferenced only if their color is white, they have
340 * not be deleted and have a minimum age to avoid false positives caused by
341 * pointers temporarily stored in CPU registers.
342 */
Luis R. Rodriguez4a558dd2009-09-08 16:34:50 +0100343static bool unreferenced_object(struct kmemleak_object *object)
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100344{
Catalin Marinas04609ccc2009-10-28 13:33:12 +0000345 return (color_white(object) && object->flags & OBJECT_ALLOCATED) &&
Catalin Marinasacf49682009-06-26 17:38:29 +0100346 time_before_eq(object->jiffies + jiffies_min_age,
347 jiffies_last_scan);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100348}
349
350/*
Catalin Marinasbab4a342009-06-26 17:38:26 +0100351 * Printing of the unreferenced objects information to the seq file. The
352 * print_unreferenced function must be called with the object->lock held.
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100353 */
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100354static void print_unreferenced(struct seq_file *seq,
355 struct kmemleak_object *object)
356{
357 int i;
Catalin Marinasfefdd332009-10-28 13:33:12 +0000358 unsigned int msecs_age = jiffies_to_msecs(jiffies - object->jiffies);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100359
Catalin Marinasbab4a342009-06-26 17:38:26 +0100360 seq_printf(seq, "unreferenced object 0x%08lx (size %zu):\n",
361 object->pointer, object->size);
Catalin Marinasfefdd332009-10-28 13:33:12 +0000362 seq_printf(seq, " comm \"%s\", pid %d, jiffies %lu (age %d.%03ds)\n",
363 object->comm, object->pid, object->jiffies,
364 msecs_age / 1000, msecs_age % 1000);
Sergey Senozhatsky0494e082009-08-27 14:29:18 +0100365 hex_dump_object(seq, object);
Catalin Marinasbab4a342009-06-26 17:38:26 +0100366 seq_printf(seq, " backtrace:\n");
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100367
368 for (i = 0; i < object->trace_len; i++) {
369 void *ptr = (void *)object->trace[i];
Catalin Marinasbab4a342009-06-26 17:38:26 +0100370 seq_printf(seq, " [<%p>] %pS\n", ptr, ptr);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100371 }
372}
373
374/*
375 * Print the kmemleak_object information. This function is used mainly for
376 * debugging special cases when kmemleak operations. It must be called with
377 * the object->lock held.
378 */
379static void dump_object_info(struct kmemleak_object *object)
380{
381 struct stack_trace trace;
382
383 trace.nr_entries = object->trace_len;
384 trace.entries = object->trace;
385
Joe Perchesae281062009-06-23 14:40:26 +0100386 pr_notice("Object 0x%08lx (size %zu):\n",
Michel Lespinasse85d3a312012-10-08 16:31:27 -0700387 object->pointer, object->size);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100388 pr_notice(" comm \"%s\", pid %d, jiffies %lu\n",
389 object->comm, object->pid, object->jiffies);
390 pr_notice(" min_count = %d\n", object->min_count);
391 pr_notice(" count = %d\n", object->count);
Catalin Marinas189d84e2009-08-27 14:29:15 +0100392 pr_notice(" flags = 0x%lx\n", object->flags);
Jianpeng Maaae0ad72014-06-06 14:38:16 -0700393 pr_notice(" checksum = %u\n", object->checksum);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100394 pr_notice(" backtrace:\n");
395 print_stack_trace(&trace, 4);
396}
397
398/*
Michel Lespinasse85d3a312012-10-08 16:31:27 -0700399 * Look-up a memory block metadata (kmemleak_object) in the object search
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100400 * tree based on a pointer value. If alias is 0, only values pointing to the
401 * beginning of the memory block are allowed. The kmemleak_lock must be held
402 * when calling this function.
403 */
404static struct kmemleak_object *lookup_object(unsigned long ptr, int alias)
405{
Michel Lespinasse85d3a312012-10-08 16:31:27 -0700406 struct rb_node *rb = object_tree_root.rb_node;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100407
Michel Lespinasse85d3a312012-10-08 16:31:27 -0700408 while (rb) {
409 struct kmemleak_object *object =
410 rb_entry(rb, struct kmemleak_object, rb_node);
411 if (ptr < object->pointer)
412 rb = object->rb_node.rb_left;
413 else if (object->pointer + object->size <= ptr)
414 rb = object->rb_node.rb_right;
415 else if (object->pointer == ptr || alias)
416 return object;
417 else {
Catalin Marinas5f790202011-09-28 12:17:03 +0100418 kmemleak_warn("Found object by alias at 0x%08lx\n",
419 ptr);
Catalin Marinasa7686a42010-07-19 11:54:16 +0100420 dump_object_info(object);
Michel Lespinasse85d3a312012-10-08 16:31:27 -0700421 break;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100422 }
Michel Lespinasse85d3a312012-10-08 16:31:27 -0700423 }
424 return NULL;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100425}
426
427/*
428 * Increment the object use_count. Return 1 if successful or 0 otherwise. Note
429 * that once an object's use_count reached 0, the RCU freeing was already
430 * registered and the object should no longer be used. This function must be
431 * called under the protection of rcu_read_lock().
432 */
433static int get_object(struct kmemleak_object *object)
434{
435 return atomic_inc_not_zero(&object->use_count);
436}
437
438/*
439 * RCU callback to free a kmemleak_object.
440 */
441static void free_object_rcu(struct rcu_head *rcu)
442{
Sasha Levinb67bfe02013-02-27 17:06:00 -0800443 struct hlist_node *tmp;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100444 struct kmemleak_scan_area *area;
445 struct kmemleak_object *object =
446 container_of(rcu, struct kmemleak_object, rcu);
447
448 /*
449 * Once use_count is 0 (guaranteed by put_object), there is no other
450 * code accessing this object, hence no need for locking.
451 */
Sasha Levinb67bfe02013-02-27 17:06:00 -0800452 hlist_for_each_entry_safe(area, tmp, &object->area_list, node) {
453 hlist_del(&area->node);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100454 kmem_cache_free(scan_area_cache, area);
455 }
456 kmem_cache_free(object_cache, object);
457}
458
459/*
460 * Decrement the object use_count. Once the count is 0, free the object using
461 * an RCU callback. Since put_object() may be called via the kmemleak_free() ->
462 * delete_object() path, the delayed RCU freeing ensures that there is no
463 * recursive call to the kernel allocator. Lock-less RCU object_list traversal
464 * is also possible.
465 */
466static void put_object(struct kmemleak_object *object)
467{
468 if (!atomic_dec_and_test(&object->use_count))
469 return;
470
471 /* should only get here after delete_object was called */
472 WARN_ON(object->flags & OBJECT_ALLOCATED);
473
474 call_rcu(&object->rcu, free_object_rcu);
475}
476
477/*
Michel Lespinasse85d3a312012-10-08 16:31:27 -0700478 * Look up an object in the object search tree and increase its use_count.
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100479 */
480static struct kmemleak_object *find_and_get_object(unsigned long ptr, int alias)
481{
482 unsigned long flags;
Alexey Klimov9fbed252015-11-05 18:45:57 -0800483 struct kmemleak_object *object;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100484
485 rcu_read_lock();
486 read_lock_irqsave(&kmemleak_lock, flags);
Catalin Marinas93ada572015-06-24 16:58:37 -0700487 object = lookup_object(ptr, alias);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100488 read_unlock_irqrestore(&kmemleak_lock, flags);
489
490 /* check whether the object is still available */
491 if (object && !get_object(object))
492 object = NULL;
493 rcu_read_unlock();
494
495 return object;
496}
497
498/*
Catalin Marinase781a9a2015-06-24 16:58:29 -0700499 * Look up an object in the object search tree and remove it from both
500 * object_tree_root and object_list. The returned object's use_count should be
501 * at least 1, as initially set by create_object().
502 */
503static struct kmemleak_object *find_and_remove_object(unsigned long ptr, int alias)
504{
505 unsigned long flags;
506 struct kmemleak_object *object;
507
508 write_lock_irqsave(&kmemleak_lock, flags);
509 object = lookup_object(ptr, alias);
510 if (object) {
511 rb_erase(&object->rb_node, &object_tree_root);
512 list_del_rcu(&object->object_list);
513 }
514 write_unlock_irqrestore(&kmemleak_lock, flags);
515
516 return object;
517}
518
519/*
Catalin Marinasfd678962009-08-27 14:29:17 +0100520 * Save stack trace to the given array of MAX_TRACE size.
521 */
522static int __save_stack_trace(unsigned long *trace)
523{
524 struct stack_trace stack_trace;
525
526 stack_trace.max_entries = MAX_TRACE;
527 stack_trace.nr_entries = 0;
528 stack_trace.entries = trace;
529 stack_trace.skip = 2;
530 save_stack_trace(&stack_trace);
531
532 return stack_trace.nr_entries;
533}
534
535/*
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100536 * Create the metadata (struct kmemleak_object) corresponding to an allocated
537 * memory block and add it to the object_list and object_tree_root.
538 */
Catalin Marinasfd678962009-08-27 14:29:17 +0100539static struct kmemleak_object *create_object(unsigned long ptr, size_t size,
540 int min_count, gfp_t gfp)
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100541{
542 unsigned long flags;
Michel Lespinasse85d3a312012-10-08 16:31:27 -0700543 struct kmemleak_object *object, *parent;
544 struct rb_node **link, *rb_parent;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100545
Catalin Marinas6ae4bd12011-01-27 10:30:26 +0000546 object = kmem_cache_alloc(object_cache, gfp_kmemleak_mask(gfp));
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100547 if (!object) {
Joe Perches598d8092016-03-17 14:19:44 -0700548 pr_warn("Cannot allocate a kmemleak_object structure\n");
Catalin Marinas6ae4bd12011-01-27 10:30:26 +0000549 kmemleak_disable();
Catalin Marinasfd678962009-08-27 14:29:17 +0100550 return NULL;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100551 }
552
553 INIT_LIST_HEAD(&object->object_list);
554 INIT_LIST_HEAD(&object->gray_list);
555 INIT_HLIST_HEAD(&object->area_list);
556 spin_lock_init(&object->lock);
557 atomic_set(&object->use_count, 1);
Catalin Marinas04609ccc2009-10-28 13:33:12 +0000558 object->flags = OBJECT_ALLOCATED;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100559 object->pointer = ptr;
560 object->size = size;
561 object->min_count = min_count;
Catalin Marinas04609ccc2009-10-28 13:33:12 +0000562 object->count = 0; /* white color initially */
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100563 object->jiffies = jiffies;
Catalin Marinas04609ccc2009-10-28 13:33:12 +0000564 object->checksum = 0;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100565
566 /* task information */
567 if (in_irq()) {
568 object->pid = 0;
569 strncpy(object->comm, "hardirq", sizeof(object->comm));
570 } else if (in_softirq()) {
571 object->pid = 0;
572 strncpy(object->comm, "softirq", sizeof(object->comm));
573 } else {
574 object->pid = current->pid;
575 /*
576 * There is a small chance of a race with set_task_comm(),
577 * however using get_task_comm() here may cause locking
578 * dependency issues with current->alloc_lock. In the worst
579 * case, the command line is not correct.
580 */
581 strncpy(object->comm, current->comm, sizeof(object->comm));
582 }
583
584 /* kernel backtrace */
Catalin Marinasfd678962009-08-27 14:29:17 +0100585 object->trace_len = __save_stack_trace(object->trace);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100586
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100587 write_lock_irqsave(&kmemleak_lock, flags);
Luis R. Rodriguez0580a182009-09-08 17:32:34 +0100588
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100589 min_addr = min(min_addr, ptr);
590 max_addr = max(max_addr, ptr + size);
Michel Lespinasse85d3a312012-10-08 16:31:27 -0700591 link = &object_tree_root.rb_node;
592 rb_parent = NULL;
593 while (*link) {
594 rb_parent = *link;
595 parent = rb_entry(rb_parent, struct kmemleak_object, rb_node);
596 if (ptr + size <= parent->pointer)
597 link = &parent->rb_node.rb_left;
598 else if (parent->pointer + parent->size <= ptr)
599 link = &parent->rb_node.rb_right;
600 else {
Joe Perches756a0252016-03-17 14:19:47 -0700601 kmemleak_stop("Cannot insert 0x%lx into the object search tree (overlaps existing)\n",
Michel Lespinasse85d3a312012-10-08 16:31:27 -0700602 ptr);
Catalin Marinas9d5a4c72015-06-24 16:58:34 -0700603 /*
604 * No need for parent->lock here since "parent" cannot
605 * be freed while the kmemleak_lock is held.
606 */
607 dump_object_info(parent);
Michel Lespinasse85d3a312012-10-08 16:31:27 -0700608 kmem_cache_free(object_cache, object);
Catalin Marinas9d5a4c72015-06-24 16:58:34 -0700609 object = NULL;
Michel Lespinasse85d3a312012-10-08 16:31:27 -0700610 goto out;
611 }
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100612 }
Michel Lespinasse85d3a312012-10-08 16:31:27 -0700613 rb_link_node(&object->rb_node, rb_parent, link);
614 rb_insert_color(&object->rb_node, &object_tree_root);
615
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100616 list_add_tail_rcu(&object->object_list, &object_list);
617out:
618 write_unlock_irqrestore(&kmemleak_lock, flags);
Catalin Marinasfd678962009-08-27 14:29:17 +0100619 return object;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100620}
621
622/*
Catalin Marinase781a9a2015-06-24 16:58:29 -0700623 * Mark the object as not allocated and schedule RCU freeing via put_object().
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100624 */
Catalin Marinas53238a62009-07-07 10:33:00 +0100625static void __delete_object(struct kmemleak_object *object)
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100626{
627 unsigned long flags;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100628
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100629 WARN_ON(!(object->flags & OBJECT_ALLOCATED));
Catalin Marinase781a9a2015-06-24 16:58:29 -0700630 WARN_ON(atomic_read(&object->use_count) < 1);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100631
632 /*
633 * Locking here also ensures that the corresponding memory block
634 * cannot be freed when it is being scanned.
635 */
636 spin_lock_irqsave(&object->lock, flags);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100637 object->flags &= ~OBJECT_ALLOCATED;
638 spin_unlock_irqrestore(&object->lock, flags);
639 put_object(object);
640}
641
642/*
Catalin Marinas53238a62009-07-07 10:33:00 +0100643 * Look up the metadata (struct kmemleak_object) corresponding to ptr and
644 * delete it.
645 */
646static void delete_object_full(unsigned long ptr)
647{
648 struct kmemleak_object *object;
649
Catalin Marinase781a9a2015-06-24 16:58:29 -0700650 object = find_and_remove_object(ptr, 0);
Catalin Marinas53238a62009-07-07 10:33:00 +0100651 if (!object) {
652#ifdef DEBUG
653 kmemleak_warn("Freeing unknown object at 0x%08lx\n",
654 ptr);
655#endif
656 return;
657 }
658 __delete_object(object);
Catalin Marinas53238a62009-07-07 10:33:00 +0100659}
660
661/*
662 * Look up the metadata (struct kmemleak_object) corresponding to ptr and
663 * delete it. If the memory block is partially freed, the function may create
664 * additional metadata for the remaining parts of the block.
665 */
666static void delete_object_part(unsigned long ptr, size_t size)
667{
668 struct kmemleak_object *object;
669 unsigned long start, end;
670
Catalin Marinase781a9a2015-06-24 16:58:29 -0700671 object = find_and_remove_object(ptr, 1);
Catalin Marinas53238a62009-07-07 10:33:00 +0100672 if (!object) {
673#ifdef DEBUG
Joe Perches756a0252016-03-17 14:19:47 -0700674 kmemleak_warn("Partially freeing unknown object at 0x%08lx (size %zu)\n",
675 ptr, size);
Catalin Marinas53238a62009-07-07 10:33:00 +0100676#endif
677 return;
678 }
Catalin Marinas53238a62009-07-07 10:33:00 +0100679
680 /*
681 * Create one or two objects that may result from the memory block
682 * split. Note that partial freeing is only done by free_bootmem() and
683 * this happens before kmemleak_init() is called. The path below is
684 * only executed during early log recording in kmemleak_init(), so
685 * GFP_KERNEL is enough.
686 */
687 start = object->pointer;
688 end = object->pointer + object->size;
689 if (ptr > start)
690 create_object(start, ptr - start, object->min_count,
691 GFP_KERNEL);
692 if (ptr + size < end)
693 create_object(ptr + size, end - ptr - size, object->min_count,
694 GFP_KERNEL);
695
Catalin Marinase781a9a2015-06-24 16:58:29 -0700696 __delete_object(object);
Catalin Marinas53238a62009-07-07 10:33:00 +0100697}
Luis R. Rodrigueza1084c82009-09-04 17:44:52 -0700698
699static void __paint_it(struct kmemleak_object *object, int color)
700{
701 object->min_count = color;
702 if (color == KMEMLEAK_BLACK)
703 object->flags |= OBJECT_NO_SCAN;
704}
705
706static void paint_it(struct kmemleak_object *object, int color)
707{
708 unsigned long flags;
709
710 spin_lock_irqsave(&object->lock, flags);
711 __paint_it(object, color);
712 spin_unlock_irqrestore(&object->lock, flags);
713}
714
715static void paint_ptr(unsigned long ptr, int color)
716{
717 struct kmemleak_object *object;
718
719 object = find_and_get_object(ptr, 0);
720 if (!object) {
Joe Perches756a0252016-03-17 14:19:47 -0700721 kmemleak_warn("Trying to color unknown object at 0x%08lx as %s\n",
722 ptr,
Luis R. Rodrigueza1084c82009-09-04 17:44:52 -0700723 (color == KMEMLEAK_GREY) ? "Grey" :
724 (color == KMEMLEAK_BLACK) ? "Black" : "Unknown");
725 return;
726 }
727 paint_it(object, color);
728 put_object(object);
729}
730
Catalin Marinas53238a62009-07-07 10:33:00 +0100731/*
Holger Hans Peter Freyther145b64b2010-07-22 19:54:13 +0800732 * Mark an object permanently as gray-colored so that it can no longer be
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100733 * reported as a leak. This is used in general to mark a false positive.
734 */
735static void make_gray_object(unsigned long ptr)
736{
Luis R. Rodrigueza1084c82009-09-04 17:44:52 -0700737 paint_ptr(ptr, KMEMLEAK_GREY);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100738}
739
740/*
741 * Mark the object as black-colored so that it is ignored from scans and
742 * reporting.
743 */
744static void make_black_object(unsigned long ptr)
745{
Luis R. Rodrigueza1084c82009-09-04 17:44:52 -0700746 paint_ptr(ptr, KMEMLEAK_BLACK);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100747}
748
749/*
750 * Add a scanning area to the object. If at least one such area is added,
751 * kmemleak will only scan these ranges rather than the whole memory block.
752 */
Catalin Marinasc017b4b2009-10-28 13:33:09 +0000753static void add_scan_area(unsigned long ptr, size_t size, gfp_t gfp)
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100754{
755 unsigned long flags;
756 struct kmemleak_object *object;
757 struct kmemleak_scan_area *area;
758
Catalin Marinasc017b4b2009-10-28 13:33:09 +0000759 object = find_and_get_object(ptr, 1);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100760 if (!object) {
Joe Perchesae281062009-06-23 14:40:26 +0100761 kmemleak_warn("Adding scan area to unknown object at 0x%08lx\n",
762 ptr);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100763 return;
764 }
765
Catalin Marinas6ae4bd12011-01-27 10:30:26 +0000766 area = kmem_cache_alloc(scan_area_cache, gfp_kmemleak_mask(gfp));
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100767 if (!area) {
Joe Perches598d8092016-03-17 14:19:44 -0700768 pr_warn("Cannot allocate a scan area\n");
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100769 goto out;
770 }
771
772 spin_lock_irqsave(&object->lock, flags);
Catalin Marinas7f88f882013-11-12 15:07:45 -0800773 if (size == SIZE_MAX) {
774 size = object->pointer + object->size - ptr;
775 } else if (ptr + size > object->pointer + object->size) {
Joe Perchesae281062009-06-23 14:40:26 +0100776 kmemleak_warn("Scan area larger than object 0x%08lx\n", ptr);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100777 dump_object_info(object);
778 kmem_cache_free(scan_area_cache, area);
779 goto out_unlock;
780 }
781
782 INIT_HLIST_NODE(&area->node);
Catalin Marinasc017b4b2009-10-28 13:33:09 +0000783 area->start = ptr;
784 area->size = size;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100785
786 hlist_add_head(&area->node, &object->area_list);
787out_unlock:
788 spin_unlock_irqrestore(&object->lock, flags);
789out:
790 put_object(object);
791}
792
793/*
794 * Set the OBJECT_NO_SCAN flag for the object corresponding to the give
795 * pointer. Such object will not be scanned by kmemleak but references to it
796 * are searched.
797 */
798static void object_no_scan(unsigned long ptr)
799{
800 unsigned long flags;
801 struct kmemleak_object *object;
802
803 object = find_and_get_object(ptr, 0);
804 if (!object) {
Joe Perchesae281062009-06-23 14:40:26 +0100805 kmemleak_warn("Not scanning unknown object at 0x%08lx\n", ptr);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100806 return;
807 }
808
809 spin_lock_irqsave(&object->lock, flags);
810 object->flags |= OBJECT_NO_SCAN;
811 spin_unlock_irqrestore(&object->lock, flags);
812 put_object(object);
813}
814
815/*
816 * Log an early kmemleak_* call to the early_log buffer. These calls will be
817 * processed later once kmemleak is fully initialized.
818 */
Catalin Marinasa6186d82009-08-27 14:29:16 +0100819static void __init log_early(int op_type, const void *ptr, size_t size,
Catalin Marinasc017b4b2009-10-28 13:33:09 +0000820 int min_count)
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100821{
822 unsigned long flags;
823 struct early_log *log;
824
Li Zefan8910ae82014-04-03 14:46:29 -0700825 if (kmemleak_error) {
Catalin Marinasb6693002011-09-28 17:22:56 +0100826 /* kmemleak stopped recording, just count the requests */
827 crt_early_log++;
828 return;
829 }
830
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100831 if (crt_early_log >= ARRAY_SIZE(early_log)) {
Wang Kai21cd3a62015-09-08 15:03:41 -0700832 crt_early_log++;
Catalin Marinasa9d90582009-06-25 10:16:11 +0100833 kmemleak_disable();
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100834 return;
835 }
836
837 /*
838 * There is no need for locking since the kernel is still in UP mode
839 * at this stage. Disabling the IRQs is enough.
840 */
841 local_irq_save(flags);
842 log = &early_log[crt_early_log];
843 log->op_type = op_type;
844 log->ptr = ptr;
845 log->size = size;
846 log->min_count = min_count;
Catalin Marinas5f790202011-09-28 12:17:03 +0100847 log->trace_len = __save_stack_trace(log->trace);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100848 crt_early_log++;
849 local_irq_restore(flags);
850}
851
852/*
Catalin Marinasfd678962009-08-27 14:29:17 +0100853 * Log an early allocated block and populate the stack trace.
854 */
855static void early_alloc(struct early_log *log)
856{
857 struct kmemleak_object *object;
858 unsigned long flags;
859 int i;
860
Li Zefan8910ae82014-04-03 14:46:29 -0700861 if (!kmemleak_enabled || !log->ptr || IS_ERR(log->ptr))
Catalin Marinasfd678962009-08-27 14:29:17 +0100862 return;
863
864 /*
865 * RCU locking needed to ensure object is not freed via put_object().
866 */
867 rcu_read_lock();
868 object = create_object((unsigned long)log->ptr, log->size,
Tetsuo Handac1bcd6b2009-10-09 10:39:24 +0100869 log->min_count, GFP_ATOMIC);
Catalin Marinas0d5d1aa2009-10-09 10:30:34 +0100870 if (!object)
871 goto out;
Catalin Marinasfd678962009-08-27 14:29:17 +0100872 spin_lock_irqsave(&object->lock, flags);
873 for (i = 0; i < log->trace_len; i++)
874 object->trace[i] = log->trace[i];
875 object->trace_len = log->trace_len;
876 spin_unlock_irqrestore(&object->lock, flags);
Catalin Marinas0d5d1aa2009-10-09 10:30:34 +0100877out:
Catalin Marinasfd678962009-08-27 14:29:17 +0100878 rcu_read_unlock();
879}
880
Catalin Marinasf528f0b2011-09-26 17:12:53 +0100881/*
882 * Log an early allocated block and populate the stack trace.
883 */
884static void early_alloc_percpu(struct early_log *log)
885{
886 unsigned int cpu;
887 const void __percpu *ptr = log->ptr;
888
889 for_each_possible_cpu(cpu) {
890 log->ptr = per_cpu_ptr(ptr, cpu);
891 early_alloc(log);
892 }
893}
894
Catalin Marinasa2b6bf62010-07-19 11:54:17 +0100895/**
896 * kmemleak_alloc - register a newly allocated object
897 * @ptr: pointer to beginning of the object
898 * @size: size of the object
899 * @min_count: minimum number of references to this object. If during memory
900 * scanning a number of references less than @min_count is found,
901 * the object is reported as a memory leak. If @min_count is 0,
902 * the object is never reported as a leak. If @min_count is -1,
903 * the object is ignored (not scanned and not reported as a leak)
904 * @gfp: kmalloc() flags used for kmemleak internal memory allocations
905 *
906 * This function is called from the kernel allocators when a new object
907 * (memory block) is allocated (kmem_cache_alloc, kmalloc, vmalloc etc.).
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100908 */
Catalin Marinasa6186d82009-08-27 14:29:16 +0100909void __ref kmemleak_alloc(const void *ptr, size_t size, int min_count,
910 gfp_t gfp)
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100911{
912 pr_debug("%s(0x%p, %zu, %d)\n", __func__, ptr, size, min_count);
913
Li Zefan8910ae82014-04-03 14:46:29 -0700914 if (kmemleak_enabled && ptr && !IS_ERR(ptr))
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100915 create_object((unsigned long)ptr, size, min_count, gfp);
Li Zefan8910ae82014-04-03 14:46:29 -0700916 else if (kmemleak_early_log)
Catalin Marinasc017b4b2009-10-28 13:33:09 +0000917 log_early(KMEMLEAK_ALLOC, ptr, size, min_count);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100918}
919EXPORT_SYMBOL_GPL(kmemleak_alloc);
920
Catalin Marinasa2b6bf62010-07-19 11:54:17 +0100921/**
Catalin Marinasf528f0b2011-09-26 17:12:53 +0100922 * kmemleak_alloc_percpu - register a newly allocated __percpu object
923 * @ptr: __percpu pointer to beginning of the object
924 * @size: size of the object
Larry Finger8a8c35f2015-06-24 16:58:51 -0700925 * @gfp: flags used for kmemleak internal memory allocations
Catalin Marinasf528f0b2011-09-26 17:12:53 +0100926 *
927 * This function is called from the kernel percpu allocator when a new object
Larry Finger8a8c35f2015-06-24 16:58:51 -0700928 * (memory block) is allocated (alloc_percpu).
Catalin Marinasf528f0b2011-09-26 17:12:53 +0100929 */
Larry Finger8a8c35f2015-06-24 16:58:51 -0700930void __ref kmemleak_alloc_percpu(const void __percpu *ptr, size_t size,
931 gfp_t gfp)
Catalin Marinasf528f0b2011-09-26 17:12:53 +0100932{
933 unsigned int cpu;
934
935 pr_debug("%s(0x%p, %zu)\n", __func__, ptr, size);
936
937 /*
938 * Percpu allocations are only scanned and not reported as leaks
939 * (min_count is set to 0).
940 */
Li Zefan8910ae82014-04-03 14:46:29 -0700941 if (kmemleak_enabled && ptr && !IS_ERR(ptr))
Catalin Marinasf528f0b2011-09-26 17:12:53 +0100942 for_each_possible_cpu(cpu)
943 create_object((unsigned long)per_cpu_ptr(ptr, cpu),
Larry Finger8a8c35f2015-06-24 16:58:51 -0700944 size, 0, gfp);
Li Zefan8910ae82014-04-03 14:46:29 -0700945 else if (kmemleak_early_log)
Catalin Marinasf528f0b2011-09-26 17:12:53 +0100946 log_early(KMEMLEAK_ALLOC_PERCPU, ptr, size, 0);
947}
948EXPORT_SYMBOL_GPL(kmemleak_alloc_percpu);
949
950/**
Catalin Marinasa2b6bf62010-07-19 11:54:17 +0100951 * kmemleak_free - unregister a previously registered object
952 * @ptr: pointer to beginning of the object
953 *
954 * This function is called from the kernel allocators when an object (memory
955 * block) is freed (kmem_cache_free, kfree, vfree etc.).
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100956 */
Catalin Marinasa6186d82009-08-27 14:29:16 +0100957void __ref kmemleak_free(const void *ptr)
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100958{
959 pr_debug("%s(0x%p)\n", __func__, ptr);
960
Catalin Marinasc5f3b1a2015-06-24 16:58:26 -0700961 if (kmemleak_free_enabled && ptr && !IS_ERR(ptr))
Catalin Marinas53238a62009-07-07 10:33:00 +0100962 delete_object_full((unsigned long)ptr);
Li Zefan8910ae82014-04-03 14:46:29 -0700963 else if (kmemleak_early_log)
Catalin Marinasc017b4b2009-10-28 13:33:09 +0000964 log_early(KMEMLEAK_FREE, ptr, 0, 0);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +0100965}
966EXPORT_SYMBOL_GPL(kmemleak_free);
967
Catalin Marinasa2b6bf62010-07-19 11:54:17 +0100968/**
969 * kmemleak_free_part - partially unregister a previously registered object
970 * @ptr: pointer to the beginning or inside the object. This also
971 * represents the start of the range to be freed
972 * @size: size to be unregistered
973 *
974 * This function is called when only a part of a memory block is freed
975 * (usually from the bootmem allocator).
Catalin Marinas53238a62009-07-07 10:33:00 +0100976 */
Catalin Marinasa6186d82009-08-27 14:29:16 +0100977void __ref kmemleak_free_part(const void *ptr, size_t size)
Catalin Marinas53238a62009-07-07 10:33:00 +0100978{
979 pr_debug("%s(0x%p)\n", __func__, ptr);
980
Li Zefan8910ae82014-04-03 14:46:29 -0700981 if (kmemleak_enabled && ptr && !IS_ERR(ptr))
Catalin Marinas53238a62009-07-07 10:33:00 +0100982 delete_object_part((unsigned long)ptr, size);
Li Zefan8910ae82014-04-03 14:46:29 -0700983 else if (kmemleak_early_log)
Catalin Marinasc017b4b2009-10-28 13:33:09 +0000984 log_early(KMEMLEAK_FREE_PART, ptr, size, 0);
Catalin Marinas53238a62009-07-07 10:33:00 +0100985}
986EXPORT_SYMBOL_GPL(kmemleak_free_part);
987
Catalin Marinasa2b6bf62010-07-19 11:54:17 +0100988/**
Catalin Marinasf528f0b2011-09-26 17:12:53 +0100989 * kmemleak_free_percpu - unregister a previously registered __percpu object
990 * @ptr: __percpu pointer to beginning of the object
991 *
992 * This function is called from the kernel percpu allocator when an object
993 * (memory block) is freed (free_percpu).
994 */
995void __ref kmemleak_free_percpu(const void __percpu *ptr)
996{
997 unsigned int cpu;
998
999 pr_debug("%s(0x%p)\n", __func__, ptr);
1000
Catalin Marinasc5f3b1a2015-06-24 16:58:26 -07001001 if (kmemleak_free_enabled && ptr && !IS_ERR(ptr))
Catalin Marinasf528f0b2011-09-26 17:12:53 +01001002 for_each_possible_cpu(cpu)
1003 delete_object_full((unsigned long)per_cpu_ptr(ptr,
1004 cpu));
Li Zefan8910ae82014-04-03 14:46:29 -07001005 else if (kmemleak_early_log)
Catalin Marinasf528f0b2011-09-26 17:12:53 +01001006 log_early(KMEMLEAK_FREE_PERCPU, ptr, 0, 0);
1007}
1008EXPORT_SYMBOL_GPL(kmemleak_free_percpu);
1009
1010/**
Catalin Marinasffe2c742014-06-06 14:38:17 -07001011 * kmemleak_update_trace - update object allocation stack trace
1012 * @ptr: pointer to beginning of the object
1013 *
1014 * Override the object allocation stack trace for cases where the actual
1015 * allocation place is not always useful.
1016 */
1017void __ref kmemleak_update_trace(const void *ptr)
1018{
1019 struct kmemleak_object *object;
1020 unsigned long flags;
1021
1022 pr_debug("%s(0x%p)\n", __func__, ptr);
1023
1024 if (!kmemleak_enabled || IS_ERR_OR_NULL(ptr))
1025 return;
1026
1027 object = find_and_get_object((unsigned long)ptr, 1);
1028 if (!object) {
1029#ifdef DEBUG
1030 kmemleak_warn("Updating stack trace for unknown object at %p\n",
1031 ptr);
1032#endif
1033 return;
1034 }
1035
1036 spin_lock_irqsave(&object->lock, flags);
1037 object->trace_len = __save_stack_trace(object->trace);
1038 spin_unlock_irqrestore(&object->lock, flags);
1039
1040 put_object(object);
1041}
1042EXPORT_SYMBOL(kmemleak_update_trace);
1043
1044/**
Catalin Marinasa2b6bf62010-07-19 11:54:17 +01001045 * kmemleak_not_leak - mark an allocated object as false positive
1046 * @ptr: pointer to beginning of the object
1047 *
1048 * Calling this function on an object will cause the memory block to no longer
1049 * be reported as leak and always be scanned.
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001050 */
Catalin Marinasa6186d82009-08-27 14:29:16 +01001051void __ref kmemleak_not_leak(const void *ptr)
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001052{
1053 pr_debug("%s(0x%p)\n", __func__, ptr);
1054
Li Zefan8910ae82014-04-03 14:46:29 -07001055 if (kmemleak_enabled && ptr && !IS_ERR(ptr))
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001056 make_gray_object((unsigned long)ptr);
Li Zefan8910ae82014-04-03 14:46:29 -07001057 else if (kmemleak_early_log)
Catalin Marinasc017b4b2009-10-28 13:33:09 +00001058 log_early(KMEMLEAK_NOT_LEAK, ptr, 0, 0);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001059}
1060EXPORT_SYMBOL(kmemleak_not_leak);
1061
Catalin Marinasa2b6bf62010-07-19 11:54:17 +01001062/**
1063 * kmemleak_ignore - ignore an allocated object
1064 * @ptr: pointer to beginning of the object
1065 *
1066 * Calling this function on an object will cause the memory block to be
1067 * ignored (not scanned and not reported as a leak). This is usually done when
1068 * it is known that the corresponding block is not a leak and does not contain
1069 * any references to other allocated memory blocks.
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001070 */
Catalin Marinasa6186d82009-08-27 14:29:16 +01001071void __ref kmemleak_ignore(const void *ptr)
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001072{
1073 pr_debug("%s(0x%p)\n", __func__, ptr);
1074
Li Zefan8910ae82014-04-03 14:46:29 -07001075 if (kmemleak_enabled && ptr && !IS_ERR(ptr))
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001076 make_black_object((unsigned long)ptr);
Li Zefan8910ae82014-04-03 14:46:29 -07001077 else if (kmemleak_early_log)
Catalin Marinasc017b4b2009-10-28 13:33:09 +00001078 log_early(KMEMLEAK_IGNORE, ptr, 0, 0);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001079}
1080EXPORT_SYMBOL(kmemleak_ignore);
1081
Catalin Marinasa2b6bf62010-07-19 11:54:17 +01001082/**
1083 * kmemleak_scan_area - limit the range to be scanned in an allocated object
1084 * @ptr: pointer to beginning or inside the object. This also
1085 * represents the start of the scan area
1086 * @size: size of the scan area
1087 * @gfp: kmalloc() flags used for kmemleak internal memory allocations
1088 *
1089 * This function is used when it is known that only certain parts of an object
1090 * contain references to other objects. Kmemleak will only scan these areas
1091 * reducing the number false negatives.
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001092 */
Catalin Marinasc017b4b2009-10-28 13:33:09 +00001093void __ref kmemleak_scan_area(const void *ptr, size_t size, gfp_t gfp)
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001094{
1095 pr_debug("%s(0x%p)\n", __func__, ptr);
1096
Li Zefan8910ae82014-04-03 14:46:29 -07001097 if (kmemleak_enabled && ptr && size && !IS_ERR(ptr))
Catalin Marinasc017b4b2009-10-28 13:33:09 +00001098 add_scan_area((unsigned long)ptr, size, gfp);
Li Zefan8910ae82014-04-03 14:46:29 -07001099 else if (kmemleak_early_log)
Catalin Marinasc017b4b2009-10-28 13:33:09 +00001100 log_early(KMEMLEAK_SCAN_AREA, ptr, size, 0);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001101}
1102EXPORT_SYMBOL(kmemleak_scan_area);
1103
Catalin Marinasa2b6bf62010-07-19 11:54:17 +01001104/**
1105 * kmemleak_no_scan - do not scan an allocated object
1106 * @ptr: pointer to beginning of the object
1107 *
1108 * This function notifies kmemleak not to scan the given memory block. Useful
1109 * in situations where it is known that the given object does not contain any
1110 * references to other objects. Kmemleak will not scan such objects reducing
1111 * the number of false negatives.
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001112 */
Catalin Marinasa6186d82009-08-27 14:29:16 +01001113void __ref kmemleak_no_scan(const void *ptr)
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001114{
1115 pr_debug("%s(0x%p)\n", __func__, ptr);
1116
Li Zefan8910ae82014-04-03 14:46:29 -07001117 if (kmemleak_enabled && ptr && !IS_ERR(ptr))
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001118 object_no_scan((unsigned long)ptr);
Li Zefan8910ae82014-04-03 14:46:29 -07001119 else if (kmemleak_early_log)
Catalin Marinasc017b4b2009-10-28 13:33:09 +00001120 log_early(KMEMLEAK_NO_SCAN, ptr, 0, 0);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001121}
1122EXPORT_SYMBOL(kmemleak_no_scan);
1123
1124/*
Catalin Marinas04609ccc2009-10-28 13:33:12 +00001125 * Update an object's checksum and return true if it was modified.
1126 */
1127static bool update_checksum(struct kmemleak_object *object)
1128{
1129 u32 old_csum = object->checksum;
1130
1131 if (!kmemcheck_is_obj_initialized(object->pointer, object->size))
1132 return false;
1133
Andrey Ryabinine79ed2f2015-02-13 14:39:49 -08001134 kasan_disable_current();
Catalin Marinas04609ccc2009-10-28 13:33:12 +00001135 object->checksum = crc32(0, (void *)object->pointer, object->size);
Andrey Ryabinine79ed2f2015-02-13 14:39:49 -08001136 kasan_enable_current();
1137
Catalin Marinas04609ccc2009-10-28 13:33:12 +00001138 return object->checksum != old_csum;
1139}
1140
1141/*
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001142 * Memory scanning is a long process and it needs to be interruptable. This
Lucas De Marchi25985ed2011-03-30 22:57:33 -03001143 * function checks whether such interrupt condition occurred.
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001144 */
1145static int scan_should_stop(void)
1146{
Li Zefan8910ae82014-04-03 14:46:29 -07001147 if (!kmemleak_enabled)
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001148 return 1;
1149
1150 /*
1151 * This function may be called from either process or kthread context,
1152 * hence the need to check for both stop conditions.
1153 */
1154 if (current->mm)
1155 return signal_pending(current);
1156 else
1157 return kthread_should_stop();
1158
1159 return 0;
1160}
1161
1162/*
1163 * Scan a memory block (exclusive range) for valid pointers and add those
1164 * found to the gray list.
1165 */
1166static void scan_block(void *_start, void *_end,
Catalin Marinas93ada572015-06-24 16:58:37 -07001167 struct kmemleak_object *scanned)
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001168{
1169 unsigned long *ptr;
1170 unsigned long *start = PTR_ALIGN(_start, BYTES_PER_POINTER);
1171 unsigned long *end = _end - (BYTES_PER_POINTER - 1);
Catalin Marinas93ada572015-06-24 16:58:37 -07001172 unsigned long flags;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001173
Catalin Marinas93ada572015-06-24 16:58:37 -07001174 read_lock_irqsave(&kmemleak_lock, flags);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001175 for (ptr = start; ptr < end; ptr++) {
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001176 struct kmemleak_object *object;
Pekka Enberg8e019362009-08-27 14:50:00 +01001177 unsigned long pointer;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001178
1179 if (scan_should_stop())
1180 break;
1181
Pekka Enberg8e019362009-08-27 14:50:00 +01001182 /* don't scan uninitialized memory */
1183 if (!kmemcheck_is_obj_initialized((unsigned long)ptr,
1184 BYTES_PER_POINTER))
1185 continue;
1186
Andrey Ryabinine79ed2f2015-02-13 14:39:49 -08001187 kasan_disable_current();
Pekka Enberg8e019362009-08-27 14:50:00 +01001188 pointer = *ptr;
Andrey Ryabinine79ed2f2015-02-13 14:39:49 -08001189 kasan_enable_current();
Pekka Enberg8e019362009-08-27 14:50:00 +01001190
Catalin Marinas93ada572015-06-24 16:58:37 -07001191 if (pointer < min_addr || pointer >= max_addr)
1192 continue;
1193
1194 /*
1195 * No need for get_object() here since we hold kmemleak_lock.
1196 * object->use_count cannot be dropped to 0 while the object
1197 * is still present in object_tree_root and object_list
1198 * (with updates protected by kmemleak_lock).
1199 */
1200 object = lookup_object(pointer, 1);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001201 if (!object)
1202 continue;
Catalin Marinas93ada572015-06-24 16:58:37 -07001203 if (object == scanned)
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001204 /* self referenced, ignore */
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001205 continue;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001206
1207 /*
1208 * Avoid the lockdep recursive warning on object->lock being
1209 * previously acquired in scan_object(). These locks are
1210 * enclosed by scan_mutex.
1211 */
Catalin Marinas93ada572015-06-24 16:58:37 -07001212 spin_lock_nested(&object->lock, SINGLE_DEPTH_NESTING);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001213 if (!color_white(object)) {
1214 /* non-orphan, ignored or new */
Catalin Marinas93ada572015-06-24 16:58:37 -07001215 spin_unlock(&object->lock);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001216 continue;
1217 }
1218
1219 /*
1220 * Increase the object's reference count (number of pointers
1221 * to the memory block). If this count reaches the required
1222 * minimum, the object's color will become gray and it will be
1223 * added to the gray_list.
1224 */
1225 object->count++;
Catalin Marinas0587da42009-10-28 13:33:11 +00001226 if (color_gray(object)) {
Catalin Marinas93ada572015-06-24 16:58:37 -07001227 /* put_object() called when removing from gray_list */
1228 WARN_ON(!get_object(object));
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001229 list_add_tail(&object->gray_list, &gray_list);
Catalin Marinas0587da42009-10-28 13:33:11 +00001230 }
Catalin Marinas93ada572015-06-24 16:58:37 -07001231 spin_unlock(&object->lock);
1232 }
1233 read_unlock_irqrestore(&kmemleak_lock, flags);
1234}
Catalin Marinas0587da42009-10-28 13:33:11 +00001235
Catalin Marinas93ada572015-06-24 16:58:37 -07001236/*
1237 * Scan a large memory block in MAX_SCAN_SIZE chunks to reduce the latency.
1238 */
1239static void scan_large_block(void *start, void *end)
1240{
1241 void *next;
1242
1243 while (start < end) {
1244 next = min(start + MAX_SCAN_SIZE, end);
1245 scan_block(start, next, NULL);
1246 start = next;
1247 cond_resched();
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001248 }
1249}
1250
1251/*
1252 * Scan a memory block corresponding to a kmemleak_object. A condition is
1253 * that object->use_count >= 1.
1254 */
1255static void scan_object(struct kmemleak_object *object)
1256{
1257 struct kmemleak_scan_area *area;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001258 unsigned long flags;
1259
1260 /*
Uwe Kleine-König21ae2952009-10-07 15:21:09 +02001261 * Once the object->lock is acquired, the corresponding memory block
1262 * cannot be freed (the same lock is acquired in delete_object).
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001263 */
1264 spin_lock_irqsave(&object->lock, flags);
1265 if (object->flags & OBJECT_NO_SCAN)
1266 goto out;
1267 if (!(object->flags & OBJECT_ALLOCATED))
1268 /* already freed object */
1269 goto out;
Catalin Marinasaf986032009-08-27 14:29:12 +01001270 if (hlist_empty(&object->area_list)) {
1271 void *start = (void *)object->pointer;
1272 void *end = (void *)(object->pointer + object->size);
Catalin Marinas93ada572015-06-24 16:58:37 -07001273 void *next;
Catalin Marinasaf986032009-08-27 14:29:12 +01001274
Catalin Marinas93ada572015-06-24 16:58:37 -07001275 do {
1276 next = min(start + MAX_SCAN_SIZE, end);
1277 scan_block(start, next, object);
1278
1279 start = next;
1280 if (start >= end)
1281 break;
Catalin Marinasaf986032009-08-27 14:29:12 +01001282
1283 spin_unlock_irqrestore(&object->lock, flags);
1284 cond_resched();
1285 spin_lock_irqsave(&object->lock, flags);
Catalin Marinas93ada572015-06-24 16:58:37 -07001286 } while (object->flags & OBJECT_ALLOCATED);
Catalin Marinasaf986032009-08-27 14:29:12 +01001287 } else
Sasha Levinb67bfe02013-02-27 17:06:00 -08001288 hlist_for_each_entry(area, &object->area_list, node)
Catalin Marinasc017b4b2009-10-28 13:33:09 +00001289 scan_block((void *)area->start,
1290 (void *)(area->start + area->size),
Catalin Marinas93ada572015-06-24 16:58:37 -07001291 object);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001292out:
1293 spin_unlock_irqrestore(&object->lock, flags);
1294}
1295
1296/*
Catalin Marinas04609ccc2009-10-28 13:33:12 +00001297 * Scan the objects already referenced (gray objects). More objects will be
1298 * referenced and, if there are no memory leaks, all the objects are scanned.
1299 */
1300static void scan_gray_list(void)
1301{
1302 struct kmemleak_object *object, *tmp;
1303
1304 /*
1305 * The list traversal is safe for both tail additions and removals
1306 * from inside the loop. The kmemleak objects cannot be freed from
1307 * outside the loop because their use_count was incremented.
1308 */
1309 object = list_entry(gray_list.next, typeof(*object), gray_list);
1310 while (&object->gray_list != &gray_list) {
1311 cond_resched();
1312
1313 /* may add new objects to the list */
1314 if (!scan_should_stop())
1315 scan_object(object);
1316
1317 tmp = list_entry(object->gray_list.next, typeof(*object),
1318 gray_list);
1319
1320 /* remove the object from the list and release it */
1321 list_del(&object->gray_list);
1322 put_object(object);
1323
1324 object = tmp;
1325 }
1326 WARN_ON(!list_empty(&gray_list));
1327}
1328
1329/*
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001330 * Scan data sections and all the referenced memory blocks allocated via the
1331 * kernel's standard allocators. This function must be called with the
1332 * scan_mutex held.
1333 */
1334static void kmemleak_scan(void)
1335{
1336 unsigned long flags;
Catalin Marinas04609ccc2009-10-28 13:33:12 +00001337 struct kmemleak_object *object;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001338 int i;
Catalin Marinas4698c1f2009-06-26 17:38:27 +01001339 int new_leaks = 0;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001340
Catalin Marinasacf49682009-06-26 17:38:29 +01001341 jiffies_last_scan = jiffies;
1342
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001343 /* prepare the kmemleak_object's */
1344 rcu_read_lock();
1345 list_for_each_entry_rcu(object, &object_list, object_list) {
1346 spin_lock_irqsave(&object->lock, flags);
1347#ifdef DEBUG
1348 /*
1349 * With a few exceptions there should be a maximum of
1350 * 1 reference to any object at this point.
1351 */
1352 if (atomic_read(&object->use_count) > 1) {
Joe Perchesae281062009-06-23 14:40:26 +01001353 pr_debug("object->use_count = %d\n",
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001354 atomic_read(&object->use_count));
1355 dump_object_info(object);
1356 }
1357#endif
1358 /* reset the reference count (whiten the object) */
1359 object->count = 0;
1360 if (color_gray(object) && get_object(object))
1361 list_add_tail(&object->gray_list, &gray_list);
1362
1363 spin_unlock_irqrestore(&object->lock, flags);
1364 }
1365 rcu_read_unlock();
1366
1367 /* data/bss scanning */
Catalin Marinas93ada572015-06-24 16:58:37 -07001368 scan_large_block(_sdata, _edata);
1369 scan_large_block(__bss_start, __bss_stop);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001370
1371#ifdef CONFIG_SMP
1372 /* per-cpu sections scanning */
1373 for_each_possible_cpu(i)
Catalin Marinas93ada572015-06-24 16:58:37 -07001374 scan_large_block(__per_cpu_start + per_cpu_offset(i),
1375 __per_cpu_end + per_cpu_offset(i));
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001376#endif
1377
1378 /*
Laura Abbott029aeff2011-11-15 23:49:09 +00001379 * Struct page scanning for each node.
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001380 */
Vladimir Davydovbfc8c902014-06-04 16:07:18 -07001381 get_online_mems();
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001382 for_each_online_node(i) {
Cody P Schafer108bcc92013-02-22 16:35:23 -08001383 unsigned long start_pfn = node_start_pfn(i);
1384 unsigned long end_pfn = node_end_pfn(i);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001385 unsigned long pfn;
1386
1387 for (pfn = start_pfn; pfn < end_pfn; pfn++) {
1388 struct page *page;
1389
1390 if (!pfn_valid(pfn))
1391 continue;
1392 page = pfn_to_page(pfn);
1393 /* only scan if page is in use */
1394 if (page_count(page) == 0)
1395 continue;
Catalin Marinas93ada572015-06-24 16:58:37 -07001396 scan_block(page, page + 1, NULL);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001397 }
1398 }
Vladimir Davydovbfc8c902014-06-04 16:07:18 -07001399 put_online_mems();
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001400
1401 /*
Catalin Marinas43ed5d62009-09-01 11:12:44 +01001402 * Scanning the task stacks (may introduce false negatives).
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001403 */
1404 if (kmemleak_stack_scan) {
Catalin Marinas43ed5d62009-09-01 11:12:44 +01001405 struct task_struct *p, *g;
1406
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001407 read_lock(&tasklist_lock);
Catalin Marinas43ed5d62009-09-01 11:12:44 +01001408 do_each_thread(g, p) {
1409 scan_block(task_stack_page(p), task_stack_page(p) +
Catalin Marinas93ada572015-06-24 16:58:37 -07001410 THREAD_SIZE, NULL);
Catalin Marinas43ed5d62009-09-01 11:12:44 +01001411 } while_each_thread(g, p);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001412 read_unlock(&tasklist_lock);
1413 }
1414
1415 /*
1416 * Scan the objects already referenced from the sections scanned
Catalin Marinas04609ccc2009-10-28 13:33:12 +00001417 * above.
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001418 */
Catalin Marinas04609ccc2009-10-28 13:33:12 +00001419 scan_gray_list();
Catalin Marinas25873622009-07-07 10:32:58 +01001420
1421 /*
Catalin Marinas04609ccc2009-10-28 13:33:12 +00001422 * Check for new or unreferenced objects modified since the previous
1423 * scan and color them gray until the next scan.
Catalin Marinas25873622009-07-07 10:32:58 +01001424 */
1425 rcu_read_lock();
1426 list_for_each_entry_rcu(object, &object_list, object_list) {
1427 spin_lock_irqsave(&object->lock, flags);
Catalin Marinas04609ccc2009-10-28 13:33:12 +00001428 if (color_white(object) && (object->flags & OBJECT_ALLOCATED)
1429 && update_checksum(object) && get_object(object)) {
1430 /* color it gray temporarily */
1431 object->count = object->min_count;
Catalin Marinas25873622009-07-07 10:32:58 +01001432 list_add_tail(&object->gray_list, &gray_list);
1433 }
1434 spin_unlock_irqrestore(&object->lock, flags);
1435 }
1436 rcu_read_unlock();
1437
Catalin Marinas04609ccc2009-10-28 13:33:12 +00001438 /*
1439 * Re-scan the gray list for modified unreferenced objects.
1440 */
1441 scan_gray_list();
Catalin Marinas4698c1f2009-06-26 17:38:27 +01001442
1443 /*
Catalin Marinas04609ccc2009-10-28 13:33:12 +00001444 * If scanning was stopped do not report any new unreferenced objects.
Catalin Marinas17bb9e02009-06-29 17:13:56 +01001445 */
Catalin Marinas04609ccc2009-10-28 13:33:12 +00001446 if (scan_should_stop())
Catalin Marinas17bb9e02009-06-29 17:13:56 +01001447 return;
1448
1449 /*
Catalin Marinas4698c1f2009-06-26 17:38:27 +01001450 * Scanning result reporting.
1451 */
1452 rcu_read_lock();
1453 list_for_each_entry_rcu(object, &object_list, object_list) {
1454 spin_lock_irqsave(&object->lock, flags);
1455 if (unreferenced_object(object) &&
1456 !(object->flags & OBJECT_REPORTED)) {
1457 object->flags |= OBJECT_REPORTED;
1458 new_leaks++;
1459 }
1460 spin_unlock_irqrestore(&object->lock, flags);
1461 }
1462 rcu_read_unlock();
1463
Li Zefandc9b3f42014-04-03 14:46:26 -07001464 if (new_leaks) {
1465 kmemleak_found_leaks = true;
1466
Joe Perches756a0252016-03-17 14:19:47 -07001467 pr_info("%d new suspected memory leaks (see /sys/kernel/debug/kmemleak)\n",
1468 new_leaks);
Li Zefandc9b3f42014-04-03 14:46:26 -07001469 }
Catalin Marinas4698c1f2009-06-26 17:38:27 +01001470
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001471}
1472
1473/*
1474 * Thread function performing automatic memory scanning. Unreferenced objects
1475 * at the end of a memory scan are reported but only the first time.
1476 */
1477static int kmemleak_scan_thread(void *arg)
1478{
1479 static int first_run = 1;
1480
Joe Perchesae281062009-06-23 14:40:26 +01001481 pr_info("Automatic memory scanning thread started\n");
Catalin Marinasbf2a76b2009-07-07 10:32:55 +01001482 set_user_nice(current, 10);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001483
1484 /*
1485 * Wait before the first scan to allow the system to fully initialize.
1486 */
1487 if (first_run) {
Vegard Nossum98c42d92016-07-28 15:48:32 -07001488 signed long timeout = msecs_to_jiffies(SECS_FIRST_SCAN * 1000);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001489 first_run = 0;
Vegard Nossum98c42d92016-07-28 15:48:32 -07001490 while (timeout && !kthread_should_stop())
1491 timeout = schedule_timeout_interruptible(timeout);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001492 }
1493
1494 while (!kthread_should_stop()) {
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001495 signed long timeout = jiffies_scan_wait;
1496
1497 mutex_lock(&scan_mutex);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001498 kmemleak_scan();
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001499 mutex_unlock(&scan_mutex);
Catalin Marinas4698c1f2009-06-26 17:38:27 +01001500
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001501 /* wait before the next scan */
1502 while (timeout && !kthread_should_stop())
1503 timeout = schedule_timeout_interruptible(timeout);
1504 }
1505
Joe Perchesae281062009-06-23 14:40:26 +01001506 pr_info("Automatic memory scanning thread ended\n");
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001507
1508 return 0;
1509}
1510
1511/*
1512 * Start the automatic memory scanning thread. This function must be called
Catalin Marinas4698c1f2009-06-26 17:38:27 +01001513 * with the scan_mutex held.
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001514 */
Luis R. Rodriguez7eb0d5e2009-09-08 17:31:45 +01001515static void start_scan_thread(void)
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001516{
1517 if (scan_thread)
1518 return;
1519 scan_thread = kthread_run(kmemleak_scan_thread, NULL, "kmemleak");
1520 if (IS_ERR(scan_thread)) {
Joe Perches598d8092016-03-17 14:19:44 -07001521 pr_warn("Failed to create the scan thread\n");
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001522 scan_thread = NULL;
1523 }
1524}
1525
1526/*
1527 * Stop the automatic memory scanning thread. This function must be called
Catalin Marinas4698c1f2009-06-26 17:38:27 +01001528 * with the scan_mutex held.
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001529 */
Luis R. Rodriguez7eb0d5e2009-09-08 17:31:45 +01001530static void stop_scan_thread(void)
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001531{
1532 if (scan_thread) {
1533 kthread_stop(scan_thread);
1534 scan_thread = NULL;
1535 }
1536}
1537
1538/*
1539 * Iterate over the object_list and return the first valid object at or after
1540 * the required position with its use_count incremented. The function triggers
1541 * a memory scanning when the pos argument points to the first position.
1542 */
1543static void *kmemleak_seq_start(struct seq_file *seq, loff_t *pos)
1544{
1545 struct kmemleak_object *object;
1546 loff_t n = *pos;
Catalin Marinasb87324d2009-07-07 10:32:58 +01001547 int err;
1548
1549 err = mutex_lock_interruptible(&scan_mutex);
1550 if (err < 0)
1551 return ERR_PTR(err);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001552
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001553 rcu_read_lock();
1554 list_for_each_entry_rcu(object, &object_list, object_list) {
1555 if (n-- > 0)
1556 continue;
1557 if (get_object(object))
1558 goto out;
1559 }
1560 object = NULL;
1561out:
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001562 return object;
1563}
1564
1565/*
1566 * Return the next object in the object_list. The function decrements the
1567 * use_count of the previous object and increases that of the next one.
1568 */
1569static void *kmemleak_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1570{
1571 struct kmemleak_object *prev_obj = v;
1572 struct kmemleak_object *next_obj = NULL;
Michael Wang58fac092012-08-17 12:33:34 +08001573 struct kmemleak_object *obj = prev_obj;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001574
1575 ++(*pos);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001576
Michael Wang58fac092012-08-17 12:33:34 +08001577 list_for_each_entry_continue_rcu(obj, &object_list, object_list) {
Catalin Marinas52c3ce42011-04-27 16:44:26 +01001578 if (get_object(obj)) {
1579 next_obj = obj;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001580 break;
Catalin Marinas52c3ce42011-04-27 16:44:26 +01001581 }
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001582 }
Catalin Marinas288c8572009-07-07 10:32:57 +01001583
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001584 put_object(prev_obj);
1585 return next_obj;
1586}
1587
1588/*
1589 * Decrement the use_count of the last object required, if any.
1590 */
1591static void kmemleak_seq_stop(struct seq_file *seq, void *v)
1592{
Catalin Marinasb87324d2009-07-07 10:32:58 +01001593 if (!IS_ERR(v)) {
1594 /*
1595 * kmemleak_seq_start may return ERR_PTR if the scan_mutex
1596 * waiting was interrupted, so only release it if !IS_ERR.
1597 */
Catalin Marinasf5886c72009-07-29 16:26:57 +01001598 rcu_read_unlock();
Catalin Marinasb87324d2009-07-07 10:32:58 +01001599 mutex_unlock(&scan_mutex);
1600 if (v)
1601 put_object(v);
1602 }
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001603}
1604
1605/*
1606 * Print the information for an unreferenced object to the seq file.
1607 */
1608static int kmemleak_seq_show(struct seq_file *seq, void *v)
1609{
1610 struct kmemleak_object *object = v;
1611 unsigned long flags;
1612
1613 spin_lock_irqsave(&object->lock, flags);
Catalin Marinas288c8572009-07-07 10:32:57 +01001614 if ((object->flags & OBJECT_REPORTED) && unreferenced_object(object))
Catalin Marinas17bb9e02009-06-29 17:13:56 +01001615 print_unreferenced(seq, object);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001616 spin_unlock_irqrestore(&object->lock, flags);
1617 return 0;
1618}
1619
1620static const struct seq_operations kmemleak_seq_ops = {
1621 .start = kmemleak_seq_start,
1622 .next = kmemleak_seq_next,
1623 .stop = kmemleak_seq_stop,
1624 .show = kmemleak_seq_show,
1625};
1626
1627static int kmemleak_open(struct inode *inode, struct file *file)
1628{
Catalin Marinasb87324d2009-07-07 10:32:58 +01001629 return seq_open(file, &kmemleak_seq_ops);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001630}
1631
Catalin Marinas189d84e2009-08-27 14:29:15 +01001632static int dump_str_object_info(const char *str)
1633{
1634 unsigned long flags;
1635 struct kmemleak_object *object;
1636 unsigned long addr;
1637
Abhijit Pawardc053732012-12-18 14:23:27 -08001638 if (kstrtoul(str, 0, &addr))
1639 return -EINVAL;
Catalin Marinas189d84e2009-08-27 14:29:15 +01001640 object = find_and_get_object(addr, 0);
1641 if (!object) {
1642 pr_info("Unknown object at 0x%08lx\n", addr);
1643 return -EINVAL;
1644 }
1645
1646 spin_lock_irqsave(&object->lock, flags);
1647 dump_object_info(object);
1648 spin_unlock_irqrestore(&object->lock, flags);
1649
1650 put_object(object);
1651 return 0;
1652}
1653
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001654/*
Luis R. Rodriguez30b37102009-09-04 17:44:51 -07001655 * We use grey instead of black to ensure we can do future scans on the same
1656 * objects. If we did not do future scans these black objects could
1657 * potentially contain references to newly allocated objects in the future and
1658 * we'd end up with false positives.
1659 */
1660static void kmemleak_clear(void)
1661{
1662 struct kmemleak_object *object;
1663 unsigned long flags;
1664
1665 rcu_read_lock();
1666 list_for_each_entry_rcu(object, &object_list, object_list) {
1667 spin_lock_irqsave(&object->lock, flags);
1668 if ((object->flags & OBJECT_REPORTED) &&
1669 unreferenced_object(object))
Luis R. Rodrigueza1084c82009-09-04 17:44:52 -07001670 __paint_it(object, KMEMLEAK_GREY);
Luis R. Rodriguez30b37102009-09-04 17:44:51 -07001671 spin_unlock_irqrestore(&object->lock, flags);
1672 }
1673 rcu_read_unlock();
Li Zefandc9b3f42014-04-03 14:46:26 -07001674
1675 kmemleak_found_leaks = false;
Luis R. Rodriguez30b37102009-09-04 17:44:51 -07001676}
1677
Li Zefanc89da702014-04-03 14:46:27 -07001678static void __kmemleak_do_cleanup(void);
1679
Luis R. Rodriguez30b37102009-09-04 17:44:51 -07001680/*
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001681 * File write operation to configure kmemleak at run-time. The following
1682 * commands can be written to the /sys/kernel/debug/kmemleak file:
1683 * off - disable kmemleak (irreversible)
1684 * stack=on - enable the task stacks scanning
1685 * stack=off - disable the tasks stacks scanning
1686 * scan=on - start the automatic memory scanning thread
1687 * scan=off - stop the automatic memory scanning thread
1688 * scan=... - set the automatic memory scanning period in seconds (0 to
1689 * disable it)
Catalin Marinas4698c1f2009-06-26 17:38:27 +01001690 * scan - trigger a memory scan
Luis R. Rodriguez30b37102009-09-04 17:44:51 -07001691 * clear - mark all current reported unreferenced kmemleak objects as
Li Zefanc89da702014-04-03 14:46:27 -07001692 * grey to ignore printing them, or free all kmemleak objects
1693 * if kmemleak has been disabled.
Catalin Marinas189d84e2009-08-27 14:29:15 +01001694 * dump=... - dump information about the object found at the given address
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001695 */
1696static ssize_t kmemleak_write(struct file *file, const char __user *user_buf,
1697 size_t size, loff_t *ppos)
1698{
1699 char buf[64];
1700 int buf_size;
Catalin Marinasb87324d2009-07-07 10:32:58 +01001701 int ret;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001702
1703 buf_size = min(size, (sizeof(buf) - 1));
1704 if (strncpy_from_user(buf, user_buf, buf_size) < 0)
1705 return -EFAULT;
1706 buf[buf_size] = 0;
1707
Catalin Marinasb87324d2009-07-07 10:32:58 +01001708 ret = mutex_lock_interruptible(&scan_mutex);
1709 if (ret < 0)
1710 return ret;
1711
Li Zefanc89da702014-04-03 14:46:27 -07001712 if (strncmp(buf, "clear", 5) == 0) {
Li Zefan8910ae82014-04-03 14:46:29 -07001713 if (kmemleak_enabled)
Li Zefanc89da702014-04-03 14:46:27 -07001714 kmemleak_clear();
1715 else
1716 __kmemleak_do_cleanup();
1717 goto out;
1718 }
1719
Li Zefan8910ae82014-04-03 14:46:29 -07001720 if (!kmemleak_enabled) {
Li Zefanc89da702014-04-03 14:46:27 -07001721 ret = -EBUSY;
1722 goto out;
1723 }
1724
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001725 if (strncmp(buf, "off", 3) == 0)
1726 kmemleak_disable();
1727 else if (strncmp(buf, "stack=on", 8) == 0)
1728 kmemleak_stack_scan = 1;
1729 else if (strncmp(buf, "stack=off", 9) == 0)
1730 kmemleak_stack_scan = 0;
1731 else if (strncmp(buf, "scan=on", 7) == 0)
1732 start_scan_thread();
1733 else if (strncmp(buf, "scan=off", 8) == 0)
1734 stop_scan_thread();
1735 else if (strncmp(buf, "scan=", 5) == 0) {
1736 unsigned long secs;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001737
Jingoo Han3dbb95f2013-09-11 14:20:25 -07001738 ret = kstrtoul(buf + 5, 0, &secs);
Catalin Marinasb87324d2009-07-07 10:32:58 +01001739 if (ret < 0)
1740 goto out;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001741 stop_scan_thread();
1742 if (secs) {
1743 jiffies_scan_wait = msecs_to_jiffies(secs * 1000);
1744 start_scan_thread();
1745 }
Catalin Marinas4698c1f2009-06-26 17:38:27 +01001746 } else if (strncmp(buf, "scan", 4) == 0)
1747 kmemleak_scan();
Catalin Marinas189d84e2009-08-27 14:29:15 +01001748 else if (strncmp(buf, "dump=", 5) == 0)
1749 ret = dump_str_object_info(buf + 5);
Catalin Marinas4698c1f2009-06-26 17:38:27 +01001750 else
Catalin Marinasb87324d2009-07-07 10:32:58 +01001751 ret = -EINVAL;
1752
1753out:
1754 mutex_unlock(&scan_mutex);
1755 if (ret < 0)
1756 return ret;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001757
1758 /* ignore the rest of the buffer, only one command at a time */
1759 *ppos += size;
1760 return size;
1761}
1762
1763static const struct file_operations kmemleak_fops = {
1764 .owner = THIS_MODULE,
1765 .open = kmemleak_open,
1766 .read = seq_read,
1767 .write = kmemleak_write,
1768 .llseek = seq_lseek,
Li Zefan5f3bf192014-04-03 14:46:28 -07001769 .release = seq_release,
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001770};
1771
Li Zefanc89da702014-04-03 14:46:27 -07001772static void __kmemleak_do_cleanup(void)
1773{
1774 struct kmemleak_object *object;
1775
1776 rcu_read_lock();
1777 list_for_each_entry_rcu(object, &object_list, object_list)
1778 delete_object_full(object->pointer);
1779 rcu_read_unlock();
1780}
1781
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001782/*
Catalin Marinas74341702011-09-29 11:50:07 +01001783 * Stop the memory scanning thread and free the kmemleak internal objects if
1784 * no previous scan thread (otherwise, kmemleak may still have some useful
1785 * information on memory leaks).
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001786 */
Catalin Marinas179a8102009-09-07 10:14:42 +01001787static void kmemleak_do_cleanup(struct work_struct *work)
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001788{
Catalin Marinas4698c1f2009-06-26 17:38:27 +01001789 stop_scan_thread();
1790
Catalin Marinasc5f3b1a2015-06-24 16:58:26 -07001791 /*
1792 * Once the scan thread has stopped, it is safe to no longer track
1793 * object freeing. Ordering of the scan thread stopping and the memory
1794 * accesses below is guaranteed by the kthread_stop() function.
1795 */
1796 kmemleak_free_enabled = 0;
1797
Li Zefanc89da702014-04-03 14:46:27 -07001798 if (!kmemleak_found_leaks)
1799 __kmemleak_do_cleanup();
1800 else
Joe Perches756a0252016-03-17 14:19:47 -07001801 pr_info("Kmemleak disabled without freeing internal data. Reclaim the memory with \"echo clear > /sys/kernel/debug/kmemleak\".\n");
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001802}
1803
Catalin Marinas179a8102009-09-07 10:14:42 +01001804static DECLARE_WORK(cleanup_work, kmemleak_do_cleanup);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001805
1806/*
1807 * Disable kmemleak. No memory allocation/freeing will be traced once this
1808 * function is called. Disabling kmemleak is an irreversible operation.
1809 */
1810static void kmemleak_disable(void)
1811{
1812 /* atomically check whether it was already invoked */
Li Zefan8910ae82014-04-03 14:46:29 -07001813 if (cmpxchg(&kmemleak_error, 0, 1))
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001814 return;
1815
1816 /* stop any memory operation tracing */
Li Zefan8910ae82014-04-03 14:46:29 -07001817 kmemleak_enabled = 0;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001818
1819 /* check whether it is too early for a kernel thread */
Li Zefan8910ae82014-04-03 14:46:29 -07001820 if (kmemleak_initialized)
Catalin Marinas179a8102009-09-07 10:14:42 +01001821 schedule_work(&cleanup_work);
Catalin Marinasc5f3b1a2015-06-24 16:58:26 -07001822 else
1823 kmemleak_free_enabled = 0;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001824
1825 pr_info("Kernel memory leak detector disabled\n");
1826}
1827
1828/*
1829 * Allow boot-time kmemleak disabling (enabled by default).
1830 */
1831static int kmemleak_boot_config(char *str)
1832{
1833 if (!str)
1834 return -EINVAL;
1835 if (strcmp(str, "off") == 0)
1836 kmemleak_disable();
Jason Baronab0155a2010-07-19 11:54:17 +01001837 else if (strcmp(str, "on") == 0)
1838 kmemleak_skip_disable = 1;
1839 else
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001840 return -EINVAL;
1841 return 0;
1842}
1843early_param("kmemleak", kmemleak_boot_config);
1844
Catalin Marinas5f790202011-09-28 12:17:03 +01001845static void __init print_log_trace(struct early_log *log)
1846{
1847 struct stack_trace trace;
1848
1849 trace.nr_entries = log->trace_len;
1850 trace.entries = log->trace;
1851
1852 pr_notice("Early log backtrace:\n");
1853 print_stack_trace(&trace, 2);
1854}
1855
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001856/*
Catalin Marinas20301172009-06-17 18:29:04 +01001857 * Kmemleak initialization.
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001858 */
1859void __init kmemleak_init(void)
1860{
1861 int i;
1862 unsigned long flags;
1863
Jason Baronab0155a2010-07-19 11:54:17 +01001864#ifdef CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF
1865 if (!kmemleak_skip_disable) {
Catalin Marinas3551a922014-05-09 15:36:59 -07001866 kmemleak_early_log = 0;
Jason Baronab0155a2010-07-19 11:54:17 +01001867 kmemleak_disable();
1868 return;
1869 }
1870#endif
1871
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001872 jiffies_min_age = msecs_to_jiffies(MSECS_MIN_AGE);
1873 jiffies_scan_wait = msecs_to_jiffies(SECS_SCAN_WAIT * 1000);
1874
1875 object_cache = KMEM_CACHE(kmemleak_object, SLAB_NOLEAKTRACE);
1876 scan_area_cache = KMEM_CACHE(kmemleak_scan_area, SLAB_NOLEAKTRACE);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001877
Wang Kai21cd3a62015-09-08 15:03:41 -07001878 if (crt_early_log > ARRAY_SIZE(early_log))
Joe Perches598d8092016-03-17 14:19:44 -07001879 pr_warn("Early log buffer exceeded (%d), please increase DEBUG_KMEMLEAK_EARLY_LOG_SIZE\n",
1880 crt_early_log);
Catalin Marinasb6693002011-09-28 17:22:56 +01001881
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001882 /* the kernel is still in UP mode, so disabling the IRQs is enough */
1883 local_irq_save(flags);
Catalin Marinas3551a922014-05-09 15:36:59 -07001884 kmemleak_early_log = 0;
Li Zefan8910ae82014-04-03 14:46:29 -07001885 if (kmemleak_error) {
Catalin Marinasb6693002011-09-28 17:22:56 +01001886 local_irq_restore(flags);
1887 return;
Catalin Marinasc5f3b1a2015-06-24 16:58:26 -07001888 } else {
Li Zefan8910ae82014-04-03 14:46:29 -07001889 kmemleak_enabled = 1;
Catalin Marinasc5f3b1a2015-06-24 16:58:26 -07001890 kmemleak_free_enabled = 1;
1891 }
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001892 local_irq_restore(flags);
1893
1894 /*
1895 * This is the point where tracking allocations is safe. Automatic
1896 * scanning is started during the late initcall. Add the early logged
1897 * callbacks to the kmemleak infrastructure.
1898 */
1899 for (i = 0; i < crt_early_log; i++) {
1900 struct early_log *log = &early_log[i];
1901
1902 switch (log->op_type) {
1903 case KMEMLEAK_ALLOC:
Catalin Marinasfd678962009-08-27 14:29:17 +01001904 early_alloc(log);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001905 break;
Catalin Marinasf528f0b2011-09-26 17:12:53 +01001906 case KMEMLEAK_ALLOC_PERCPU:
1907 early_alloc_percpu(log);
1908 break;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001909 case KMEMLEAK_FREE:
1910 kmemleak_free(log->ptr);
1911 break;
Catalin Marinas53238a62009-07-07 10:33:00 +01001912 case KMEMLEAK_FREE_PART:
1913 kmemleak_free_part(log->ptr, log->size);
1914 break;
Catalin Marinasf528f0b2011-09-26 17:12:53 +01001915 case KMEMLEAK_FREE_PERCPU:
1916 kmemleak_free_percpu(log->ptr);
1917 break;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001918 case KMEMLEAK_NOT_LEAK:
1919 kmemleak_not_leak(log->ptr);
1920 break;
1921 case KMEMLEAK_IGNORE:
1922 kmemleak_ignore(log->ptr);
1923 break;
1924 case KMEMLEAK_SCAN_AREA:
Catalin Marinasc017b4b2009-10-28 13:33:09 +00001925 kmemleak_scan_area(log->ptr, log->size, GFP_KERNEL);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001926 break;
1927 case KMEMLEAK_NO_SCAN:
1928 kmemleak_no_scan(log->ptr);
1929 break;
1930 default:
Catalin Marinas5f790202011-09-28 12:17:03 +01001931 kmemleak_warn("Unknown early log operation: %d\n",
1932 log->op_type);
1933 }
1934
Li Zefan8910ae82014-04-03 14:46:29 -07001935 if (kmemleak_warning) {
Catalin Marinas5f790202011-09-28 12:17:03 +01001936 print_log_trace(log);
Li Zefan8910ae82014-04-03 14:46:29 -07001937 kmemleak_warning = 0;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001938 }
1939 }
1940}
1941
1942/*
1943 * Late initialization function.
1944 */
1945static int __init kmemleak_late_init(void)
1946{
1947 struct dentry *dentry;
1948
Li Zefan8910ae82014-04-03 14:46:29 -07001949 kmemleak_initialized = 1;
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001950
Li Zefan8910ae82014-04-03 14:46:29 -07001951 if (kmemleak_error) {
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001952 /*
Lucas De Marchi25985ed2011-03-30 22:57:33 -03001953 * Some error occurred and kmemleak was disabled. There is a
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001954 * small chance that kmemleak_disable() was called immediately
1955 * after setting kmemleak_initialized and we may end up with
1956 * two clean-up threads but serialized by scan_mutex.
1957 */
Catalin Marinas179a8102009-09-07 10:14:42 +01001958 schedule_work(&cleanup_work);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001959 return -ENOMEM;
1960 }
1961
1962 dentry = debugfs_create_file("kmemleak", S_IRUGO, NULL, NULL,
1963 &kmemleak_fops);
1964 if (!dentry)
Joe Perches598d8092016-03-17 14:19:44 -07001965 pr_warn("Failed to create the debugfs kmemleak file\n");
Catalin Marinas4698c1f2009-06-26 17:38:27 +01001966 mutex_lock(&scan_mutex);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001967 start_scan_thread();
Catalin Marinas4698c1f2009-06-26 17:38:27 +01001968 mutex_unlock(&scan_mutex);
Catalin Marinas3c7b4e62009-06-11 13:22:39 +01001969
1970 pr_info("Kernel memory leak detector initialized\n");
1971
1972 return 0;
1973}
1974late_initcall(kmemleak_late_init);