linux内核内存问题检测调试

内存检测：
编译slabinfo，对应在内核源码tools/vm下

/** Slabinfo: Tool to get reports about slabs** (C) 2007 sgi, Christoph Lameter* (C) 2011 Linux Foundation, Christoph Lameter** Compile with:** gcc -o slabinfo slabinfo.c*/

gcc -o slabinfo slabinfo.c
这里用交叉工具链编译

 aarch64-linux-gnu-gcc -static slabinfo.c -o slabinfo 要加-static编译成静态生成slabinfo推送到测试机linux中

用此工具要在内核commandline中添加slub_debug=PZ参数
确保

:/ # cat /proc/cmdline
rootfstype=ramfs init=/init console=ttyS0,115200 no_console_suspend slub_debug=PZ ea

访问已经释放的内存
重复释放已释放的内存
越界访问

在内核打开如下配置

打开内核选项：
CONFIG_SLUB_DEBUG_ON
CONFIG_SLUB_DEBUG
CONFIG_SLUB_STATS
CONFIG_SLUB

如下例子
重复释放已释放的内存

make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- menuconfig

#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/init.h>
#include <linux/slab.h>static char* buf;static void create_slue_err(void){buf = kmalloc(32,GFP_KERNEL);if(buf)  {memset(buf,0x00,32);kfree(buf);printk("%s\n","free buf" );kfree(buf);//重复释放内存}return;
}static int __init my_test_init(void) {printk("init %s\n", "my_test_init 1");create_slue_err();printk("init %s\n", "my_test_init 2");return 0;
}static void __exit my_test_exit(void) {printk("%s\n","my_test_exit" );return ;
}
MODULE_LICENSE("GPL");
module_init(my_test_init);
module_exit(my_test_exit);

nsmod  /storage/DEBC3331BC330395/slub_test.ko                                 <
[ 9592.583607@3] init my_test_init 1
[ 9592.583639@3] free buf
[ 9592.583654@3] =============================================================================
[ 9592.591910@3] BUG kmalloc-64 (Tainted: G           O): Object already free
[ 9592.598722@3] -----------------------------------------------------------------------------
[ 9592.598722@3]
[ 9592.608641@3] Disabling lock debugging due to kernel taint
[ 9592.614085@3] INFO: Allocated in $x+0x3c/0x8c [slub_test] age=3 cpu=3 pid=10621
[ 9592.621328@3]        alloc_debug_processing+0x194/0x1a0
[ 9592.625979@3]        __slab_alloc.isra.60.constprop.68+0x314/0x354
[ 9592.631585@3]        kmem_cache_alloc_trace+0x188/0x1bc
[ 9592.636243@3]        $x+0x38/0x8c [slub_test]
[ 9592.640039@3]        do_one_initcall+0xd4/0x138
[ 9592.644007@3]        load_module+0x1420/0x1dbc
[ 9592.647886@3]        SyS_finit_module+0x80/0x90
[ 9592.651854@3]        cpu_switch_to+0x48/0x4c
[ 9592.655564@3] INFO: Freed in $x+0x50/0x8c [slub_test] age=7 cpu=3 pid=10621
[ 9592.662463@3]        free_debug_processing+0x1f4/0x310
[ 9592.667033@3]        __slab_free+0x268/0x3a8
[ 9592.670741@3]        kfree+0x200/0x238
[ 9592.673934@3]        $x+0x4c/0x8c [slub_test]
[ 9592.677728@3]        do_one_initcall+0xd4/0x138
[ 9592.681696@3]        load_module+0x1420/0x1dbc
[ 9592.685578@3]        SyS_finit_module+0x80/0x90
[ 9592.689544@3]        cpu_switch_to+0x48/0x4c
[ 9592.693254@3] INFO: Slab 0xffffff8040d4bb30 objects=18 used=14 fp=0xffffffc0267f28c0 flags=0x4081
[ 9592.702050@3] INFO: Object 0xffffffc0267f28c0 @offset=2240 fp=0xffffffc0267f3180
[ 9592.702050@3]
[ 9592.711023@3] Bytes b4 ffffffc0267f28b0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[ 9592.720594@3] Object ffffffc0267f28c0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[ 9592.729995@3] Object ffffffc0267f28d0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[ 9592.739397@3] Object ffffffc0267f28e0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[ 9592.748798@3] Object ffffffc0267f28f0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5  kkkkkkkkkkkkkkk.
[ 9592.758199@3] Redzone ffffffc0267f2900: bb bb bb bb bb bb bb bb                          ........
[ 9592.766997@3] Padding ffffffc0267f2a40: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[ 9592.776484@3] Padding ffffffc0267f2a50: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[ 9592.785972@3] Padding ffffffc0267f2a60: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[ 9592.795459@3] Padding ffffffc0267f2a70: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[ 9592.804949@3] CPU: 3 PID: 10621 Comm: insmod Tainted: G    B      O 3.14.29 #3
[ 9592.812105@3] Call trace:
[ 9592.814695@3] [<ffffffc001089390>] dump_backtrace+0x0/0x144
[ 9592.820214@3] [<ffffffc0010894f0>] show_stack+0x1c/0x28
[ 9592.825391@3] [<ffffffc001b1d294>] dump_stack+0x74/0xb8
[ 9592.830564@3] [<ffffffc0011b1a34>] print_trailer+0x148/0x1d0
[ 9592.836170@3] [<ffffffc0011b334c>] free_debug_processing+0x2a0/0x310
[ 9592.842466@3] [<ffffffc0011b5144>] __slab_free+0x268/0x3a8
[ 9592.847899@3] [<ffffffc0011b5710>] kfree+0x200/0x238
[ 9592.852817@3] [<ffffffbffc058068>] $x+0x68/0x8c [slub_test]
[ 9592.858336@3] [<ffffffc0010816a4>] do_one_initcall+0xd4/0x138
[ 9592.864029@3] [<ffffffc00111baec>] load_module+0x1420/0x1dbc
[ 9592.869635@3] [<ffffffc00111c600>] SyS_finit_module+0x80/0x90
[ 9592.875487@3] FIX kmalloc-64: Object at 0xffffffc0267f28c0 not freed
[ 9592.881720@3] init my_test_init 2

越界访问

static void create_slue_err(void){buf = kmalloc(32,GFP_KERNEL);if(buf)  {memset(buf,0x00,100);kfree(buf);
/*      printk("%s\n","free buf" );kfree(buf);*/}return;
}

 insmod /storage/DEBC3331BC330395/slub_test_access_free_point1.ko
[  383.873867@3] init my_test_init 1
[  383.873899@3] init my_test_init 2
p212:/ # slabinfo -v
[  388.548241@3] =============================================================================
[  388.550941@3] BUG kmalloc-64 (Tainted: G    B      O): Redzone overwritten
[  388.557746@3] -----------------------------------------------------------------------------
[  388.557746@3]
[  388.567667@3] INFO: 0xffffffc0498700c0-0xffffffc0498700c7. First byte 0x0 instead of 0xcc
[  388.575775@3] INFO: Slab 0xffffff8041956680 objects=32 used=9 fp=0xffffffc049870980 flags=0x0081
[  388.584484@3] INFO: Object 0xffffffc049870080 @offset=128 fp=0x          (null)
[  388.584484@3]
[  388.593370@3] Bytes b4 ffffffc049870070: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  388.602942@3] Object ffffffc049870080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[  388.612343@3] Object ffffffc049870090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[  388.621744@3] Object ffffffc0498700a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[  388.631145@3] Object ffffffc0498700b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[  388.640547@3] Redzone ffffffc0498700c0: 00 00 00 00 00 00 00 00                          ........
[  388.649344@3] Padding ffffffc0498700d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[  388.658832@3] Padding ffffffc0498700e0: 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ....ZZZZZZZZZZZZ
[  388.668319@3] Padding ffffffc0498700f0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  388.677810@3] CPU: 3 PID: 7181 Comm: slabinfo Tainted: G    B      O 3.14.29 #5
[  388.685051@3] Call trace:
[  388.687647@3] [<ffffffc001089390>] dump_backtrace+0x0/0x144
[  388.693161@3] [<ffffffc0010894f0>] show_stack+0x1c/0x28
[  388.698337@3] [<ffffffc001b1e854>] dump_stack+0x74/0xb8
[  388.703513@3] [<ffffffc0011b2420>] print_trailer+0x148/0x1d0
[  388.709117@3] [<ffffffc0011b2620>] check_bytes_and_report+0xec/0x124
[  388.715412@3] [<ffffffc0011b2810>] check_object+0x1b8/0x278
[  388.720933@3] [<ffffffc0011b3a60>] validate_slab_slab+0x1fc/0x24c
[  388.726969@3] [<ffffffc0011b684c>] validate_store+0xd0/0x1b4
[  388.732577@3] [<ffffffc0011b03a0>] slab_attr_store+0x40/0x60
[  388.738185@3] [<ffffffc001237ff4>] sysfs_kf_write+0x58/0x74
[  388.743704@3] [<ffffffc00123c300>] kernfs_fop_write+0xf8/0x154
[  388.749484@3] [<ffffffc0011c08e0>] vfs_write+0xac/0x198
[  388.754657@3] [<ffffffc0011c11cc>] SyS_write+0x50/0xb0
[  388.759745@3] FIX kmalloc-64: Restoring 0xffffffc0498700c0-0xffffffc0498700c7=0xcc
[  388.759745@3]

# uname -a
Linux localhost 3.14.29 #3 SMP PREEMPT Wed Jan 3 10:47:43 CST 2018 aarch64

访问已释放的内存

static void create_slue_err(void){buf = kmalloc(32,GFP_KERNEL);if(buf)  {/*memset(buf,0x00,33);*/kfree(buf);printk("%s\n","free buf" );/*kfree(buf);*/memset(buf,0x00,32);//访问已释放的内存}return;
}

orage/DEBC3331BC330395/slub_test_access_free_point.ko                         <
[  611.143223@1] init my_test_init 1
[  611.143255@1] free buf
[  611.143269@1] init my_test_init 2
[  611.143869@3] =============================================================================
[  611.143874@3] BUG kmalloc-64 (Tainted: G    B      O): Poison overwritten
[  611.143876@3] -----------------------------------------------------------------------------
[  611.143876@3]
[  611.143882@3] INFO: 0xffffffc0115bb500-0xffffffc0115bb51f. First byte 0x0 instead of 0x6b
[  611.143887@3] INFO: Slab 0xffffff8040607848 objects=32 used=32 fp=0x          (null) flags=0x0080
[  611.143889@3] INFO: Object 0xffffffc0115bb500 @offset=1280 fp=0xffffffc0115bb900
[  611.143889@3]
[  611.143895@3] Bytes b4 ffffffc0115bb4f0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  611.143898@3] Object ffffffc0115bb500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[  611.143900@3] Object ffffffc0115bb510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[  611.143903@3] Object ffffffc0115bb520: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[  611.143906@3] Object ffffffc0115bb530: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5  kkkkkkkkkkkkkkk.
[  611.143908@3] Redzone ffffffc0115bb540: bb bb bb bb bb bb bb bb                          ........
[  611.143910@3] Padding ffffffc0115bb550: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  611.143913@3] Padding ffffffc0115bb560: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  611.143915@3] Padding ffffffc0115bb570: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  611.143922@3] CPU: 3 PID: 7236 Comm: sdcard Tainted: G    B      O 3.14.29 #3
[  611.143925@3] Call trace:
[  611.143943@3] [<ffffffc001089390>] dump_backtrace+0x0/0x144
[  611.143947@3] [<ffffffc0010894f0>] show_stack+0x1c/0x28
[  611.143955@3] [<ffffffc001b1d294>] dump_stack+0x74/0xb8
[  611.143964@3] [<ffffffc0011b1a34>] print_trailer+0x148/0x1d0
[  611.143968@3] [<ffffffc0011b1c34>] check_bytes_and_report+0xec/0x124
[  611.143972@3] [<ffffffc0011b1e64>] check_object+0x1f8/0x278
[  611.143976@3] [<ffffffc0011b3d64>] alloc_debug_processing+0xbc/0x1a0
[  611.143981@3] [<ffffffc0011b4844>] __slab_alloc.isra.60.constprop.68+0x314/0x354
[  611.143985@3] [<ffffffc0011b4de8>] kmem_cache_alloc_trace+0x188/0x1bc
[  611.143993@3] [<ffffffc001377dcc>] fuse_alloc_forget+0x20/0x2c
[  611.143997@3] [<ffffffc0013709e4>] fuse_lookup_name+0x64/0x1e4
[  611.143999@3] [<ffffffc001370b98>] fuse_lookup+0x34/0x104
[  611.144006@3] [<ffffffc0011c94f0>] lookup_real+0x3c/0x7c
[  611.144009@3] [<ffffffc0011ca174>] __lookup_hash+0x50/0x6c
[  611.144014@3] [<ffffffc0011cade4>] lookup_slow+0x48/0xfc
[  611.144017@3] [<ffffffc0011ccc34>] path_lookupat+0x678/0x790
[  611.144021@3] [<ffffffc0011ccd84>] filename_lookup.isra.30+0x38/0x9c
[  611.144025@3] [<ffffffc0011cf9a0>] user_path_at_empty+0x60/0xb0
[  611.144028@3] [<ffffffc0011cfa28>] user_path_at+0x38/0x48
[  611.144032@3] [<ffffffc0011c42dc>] vfs_fstatat+0x68/0xc0
[  611.144036@3] [<ffffffc0011c4864>] SyS_newfstatat+0x34/0x58
[  611.144039@3] FIX kmalloc-64: Restoring 0xffffffc0115bb500-0xffffffc0115bb51f=0x6b
[  611.144039@3]
[  611.144042@3] FIX kmalloc-64: Marking all objects used

linux内核内存问题检测调试相关推荐

linux内核内存溢出检测,linux下有什么检测内存溢出的工具
Linux c++上常用内存泄露检测工具有valgrind, Rational purify.Valgrind免费.Valgrind 可以在 32 位或 64 位 PowerPC/Linux 内核上工 ...
Linux内核内存管理（3）：kmemcheck介绍
Linux内核内存管理 kmemcheck介绍 rtoax 2021年3月在英文原文基础上,针对中文译文增加5.10.13内核源码相关内容. 5.10.13不存在kmemcheck的概念,取代的是k ...
linux 内核内存管理
物理内存相关数据结构 page(页) Linux 内核内存管理的实现以 page 数据结构为核心,其他的内存管理设施都基于 page 数据结构,如 VMA 管理.缺页中断.RMAP.页面分配与回收等 ...
【Linux 内核内存管理】虚拟地址空间布局架构 ③ ( 内存描述符 mm_struct 结构体成员分析 | mmap | mm_rb | task_size | pgd | mm_users )
文章目录一.mm_struct 结构体成员分析 1.mmap 成员 2.mm_rb 成员 3.get_unmapped_area 函数指针 4.task_size 成员 5.pgd 成员 6.mm_ ...
【Linux 内核内存管理】内存管理架构 ④ ( 内存分配系统调用过程 | 用户层 malloc free | 系统调用层 brk mmap | 内核层 kmalloc | 内存管理流程 )
文章目录一.内存分配系统调用过程 ( 用户层 | 系统调用 | 内核层 ) 二.内存管理流程一.内存分配系统调用过程 ( 用户层 | 系统调用 | 内核层 ) " 堆内存 " ...
【Linux 内核内存管理】内存管理架构 ② ( 用户空间内存管理 | malloc | ptmalloc | 内核空间内存管理 | sys_brk | sys_mmap | sys_munmap)
文章目录一.用户空间内存管理 ( malloc / free / ptmalloc / jemalloc / tcmalloc ) 二.内核空间内存管理 1.内核内存管理系统调用 ( sys_brk ...
【Linux 内核内存管理】优化内存屏障 ③ ( 编译器屏障 | 禁止 / 开启内核抢占与方法保护临界区 | preempt_disable 禁止内核抢占源码 | 开启内核抢占源码 )
文章目录一.禁止 / 开启内核抢占与方法保护临界区二.编译器优化屏障三.preempt_disable 禁止内核抢占源码四.preempt_enable 开启内核抢占源码一.禁止 / ...
【Linux 内核内存管理】RCU 机制 ② ( RCU 机制适用场景 | RCU 机制特点 | 使用 RCU 机制保护链表 )
文章目录一.RCU 机制适用场景二.RCU 机制特点三.使用 RCU 机制保护链表一.RCU 机制适用场景在上一篇博客 [Linux 内核内存管理]RCU 机制 ① ( RCU 机制简介 ...
Bochs调试Linux内核6 - 启动过程调试 - 跳到bootsect引导程序执行
接此,Bochs调试Linux内核5 - 启动过程调试 - 认识Bootsect.S_bcbobo21cn的专栏-CSDN博客看一下,0x00007c11 这里是重复执行串传送:而后一条 ...

linux内核内存问题检测调试

linux内核内存问题检测调试相关推荐

最新文章

热门文章