linux内核内存问题检测调试
内存检测：
编译slabinfo，对应在内核源码tools/vm下
/*
* Slabinfo: Tool to get reports about slabs
*
* (C) 2007 sgi, Christoph Lameter
* (C) 2011 Linux Foundation, Christoph Lameter
*
* Compile with:
*
* gcc -o slabinfo slabinfo.c
*/gcc -o slabinfo slabinfo.c
这里用交叉工具链编译
aarch64-linux-gnu-gcc -static slabinfo.c -o slabinfo
要加-static编译成静态生成slabinfo推送到测试机linux中用此工具要在内核commandline中添加slub_debug=PZ参数
确保
:/ # cat /proc/cmdline
rootfstype=ramfs init=/init console=ttyS0,115200 no_console_suspend slub_debug=PZ ea访问已经释放的内存
重复释放已释放的内存
越界访问
在内核打开如下配置
打开内核选项：
CONFIG_SLUB_DEBUG_ON
CONFIG_SLUB_DEBUG
CONFIG_SLUB_STATS
CONFIG_SLUB
如下例子
重复释放已释放的内存
make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- menuconfig
#include nsmod /storage/DEBC3331BC330395/slub_test.ko <
[ 9592.583607@3] init my_test_init 1
[ 9592.583639@3] free buf
[ 9592.583654@3] =============================================================================
[ 9592.591910@3] BUG kmalloc-64 (Tainted: G O): Object already free
[ 9592.598722@3] -----------------------------------------------------------------------------
[ 9592.598722@3]
[ 9592.608641@3] Disabling lock debugging due to kernel taint
[ 9592.614085@3] INFO: Allocated in $x+0x3c/0x8c [slub_test] age=3 cpu=3 pid=10621
[ 9592.621328@3] alloc_debug_processing+0x194/0x1a0
[ 9592.625979@3] __slab_alloc.isra.60.constprop.68+0x314/0x354
[ 9592.631585@3] kmem_cache_alloc_trace+0x188/0x1bc
[ 9592.636243@3] $x+0x38/0x8c [slub_test]
[ 9592.640039@3] do_one_initcall+0xd4/0x138
[ 9592.644007@3] load_module+0x1420/0x1dbc
[ 9592.647886@3] SyS_finit_module+0x80/0x90
[ 9592.651854@3] cpu_switch_to+0x48/0x4c
[ 9592.655564@3] INFO: Freed in $x+0x50/0x8c [slub_test] age=7 cpu=3 pid=10621
[ 9592.662463@3] free_debug_processing+0x1f4/0x310
[ 9592.667033@3] __slab_free+0x268/0x3a8
[ 9592.670741@3] kfree+0x200/0x238
[ 9592.673934@3] $x+0x4c/0x8c [slub_test]
[ 9592.677728@3] do_one_initcall+0xd4/0x138
[ 9592.681696@3] load_module+0x1420/0x1dbc
[ 9592.685578@3] SyS_finit_module+0x80/0x90
[ 9592.689544@3] cpu_switch_to+0x48/0x4c
[ 9592.693254@3] INFO: Slab 0xffffff8040d4bb30 objects=18 used=14 fp=0xffffffc0267f28c0 flags=0x4081
[ 9592.702050@3] INFO: Object 0xffffffc0267f28c0 @offset=2240 fp=0xffffffc0267f3180
[ 9592.702050@3]
[ 9592.711023@3] Bytes b4 ffffffc0267f28b0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
[ 9592.720594@3] Object ffffffc0267f28c0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 9592.729995@3] Object ffffffc0267f28d0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 9592.739397@3] Object ffffffc0267f28e0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 9592.748798@3] Object ffffffc0267f28f0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkk.
[ 9592.758199@3] Redzone ffffffc0267f2900: bb bb bb bb bb bb bb bb ........
[ 9592.766997@3] Padding ffffffc0267f2a40: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
[ 9592.776484@3] Padding ffffffc0267f2a50: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
[ 9592.785972@3] Padding ffffffc0267f2a60: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
[ 9592.795459@3] Padding ffffffc0267f2a70: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
[ 9592.804949@3] CPU: 3 PID: 10621 Comm: insmod Tainted: G B O 3.14.29 #3
[ 9592.812105@3] Call trace:
[ 9592.814695@3] [] dump_backtrace+0x0/0x144
[ 9592.820214@3] [] show_stack+0x1c/0x28
[ 9592.825391@3] [] dump_stack+0x74/0xb8
[ 9592.830564@3] [] print_trailer+0x148/0x1d0
[ 9592.836170@3] [] free_debug_processing+0x2a0/0x310
[ 9592.842466@3] [] __slab_free+0x268/0x3a8
[ 9592.847899@3] [] kfree+0x200/0x238
[ 9592.852817@3] [] $x+0x68/0x8c [slub_test]
[ 9592.858336@3] [] do_one_initcall+0xd4/0x138
[ 9592.864029@3] [] load_module+0x1420/0x1dbc
[ 9592.869635@3] [] SyS_finit_module+0x80/0x90
[ 9592.875487@3] FIX kmalloc-64: Object at 0xffffffc0267f28c0 not freed
[ 9592.881720@3] init my_test_init 2 越界访问
static void create_slue_err(void){
buf = kmalloc(32,GFP_KERNEL);
if(buf) {
memset(buf,0x00,100);
kfree(buf);
/* printk("%s\n","free buf" );
kfree(buf);*/
}
return;
} insmod /storage/DEBC3331BC330395/slub_test_access_free_point1.ko
[ 383.873867@3] init my_test_init 1
[ 383.873899@3] init my_test_init 2
p212:/ # slabinfo -v
[ 388.548241@3] =============================================================================
[ 388.550941@3] BUG kmalloc-64 (Tainted: G B O): Redzone overwritten
[ 388.557746@3] -----------------------------------------------------------------------------
[ 388.557746@3]
[ 388.567667@3] INFO: 0xffffffc0498700c0-0xffffffc0498700c7. First byte 0x0 instead of 0xcc
[ 388.575775@3] INFO: Slab 0xffffff8041956680 objects=32 used=9 fp=0xffffffc049870980 flags=0x0081
[ 388.584484@3] INFO: Object 0xffffffc049870080 @offset=128 fp=0x (null)
[ 388.584484@3]
[ 388.593370@3] Bytes b4 ffffffc049870070: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
[ 388.602942@3] Object ffffffc049870080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 388.612343@3] Object ffffffc049870090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 388.621744@3] Object ffffffc0498700a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 388.631145@3] Object ffffffc0498700b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 388.640547@3] Redzone ffffffc0498700c0: 00 00 00 00 00 00 00 00 ........
[ 388.649344@3] Padding ffffffc0498700d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 388.658832@3] Padding ffffffc0498700e0: 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ....ZZZZZZZZZZZZ
[ 388.668319@3] Padding ffffffc0498700f0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
[ 388.677810@3] CPU: 3 PID: 7181 Comm: slabinfo Tainted: G B O 3.14.29 #5
[ 388.685051@3] Call trace:
[ 388.687647@3] [] dump_backtrace+0x0/0x144
[ 388.693161@3] [] show_stack+0x1c/0x28
[ 388.698337@3] [] dump_stack+0x74/0xb8
[ 388.703513@3] [] print_trailer+0x148/0x1d0
[ 388.709117@3] [] check_bytes_and_report+0xec/0x124
[ 388.715412@3] [] check_object+0x1b8/0x278
[ 388.720933@3] [] validate_slab_slab+0x1fc/0x24c
[ 388.726969@3] [] validate_store+0xd0/0x1b4
[ 388.732577@3] [] slab_attr_store+0x40/0x60
[ 388.738185@3] [] sysfs_kf_write+0x58/0x74
[ 388.743704@3] [] kernfs_fop_write+0xf8/0x154
[ 388.749484@3] [] vfs_write+0xac/0x198
[ 388.754657@3] [] SyS_write+0x50/0xb0
[ 388.759745@3] FIX kmalloc-64: Restoring 0xffffffc0498700c0-0xffffffc0498700c7=0xcc
[ 388.759745@3] # uname -a
Linux localhost 3.14.29 #3 SMP PREEMPT Wed Jan 3 10:47:43 CST 2018 aarch64访问已释放的内存
static void create_slue_err(void){
buf = kmalloc(32,GFP_KERNEL);
if(buf) {
/*memset(buf,0x00,33);*/
kfree(buf);
printk("%s\n","free buf" );
/*kfree(buf);*/
memset(buf,0x00,32);//访问已释放的内存
}
return;
}orage/DEBC3331BC330395/slub_test_access_free_point.ko <
[ 611.143223@1] init my_test_init 1
[ 611.143255@1] free buf
[ 611.143269@1] init my_test_init 2
[ 611.143869@3] =============================================================================
[ 611.143874@3] BUG kmalloc-64 (Tainted: G B O): Poison overwritten
[ 611.143876@3] -----------------------------------------------------------------------------
[ 611.143876@3]
[ 611.143882@3] INFO: 0xffffffc0115bb500-0xffffffc0115bb51f. First byte 0x0 instead of 0x6b
[ 611.143887@3] INFO: Slab 0xffffff8040607848 objects=32 used=32 fp=0x (null) flags=0x0080
[ 611.143889@3] INFO: Object 0xffffffc0115bb500 @offset=1280 fp=0xffffffc0115bb900
[ 611.143889@3]
[ 611.143895@3] Bytes b4 ffffffc0115bb4f0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
[ 611.143898@3] Object ffffffc0115bb500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 611.143900@3] Object ffffffc0115bb510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
[ 611.143903@3] Object ffffffc0115bb520: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
[ 611.143906@3] Object ffffffc0115bb530: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkk.
[ 611.143908@3] Redzone ffffffc0115bb540: bb bb bb bb bb bb bb bb ........
[ 611.143910@3] Padding ffffffc0115bb550: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
[ 611.143913@3] Padding ffffffc0115bb560: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
[ 611.143915@3] Padding ffffffc0115bb570: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
[ 611.143922@3] CPU: 3 PID: 7236 Comm: sdcard Tainted: G B O 3.14.29 #3
[ 611.143925@3] Call trace:
[ 611.143943@3] [] dump_backtrace+0x0/0x144
[ 611.143947@3] [] show_stack+0x1c/0x28
[ 611.143955@3] [] dump_stack+0x74/0xb8
[ 611.143964@3] [] print_trailer+0x148/0x1d0
[ 611.143968@3] [] check_bytes_and_report+0xec/0x124
[ 611.143972@3] [] check_object+0x1f8/0x278
[ 611.143976@3] [] alloc_debug_processing+0xbc/0x1a0
[ 611.143981@3] [] __slab_alloc.isra.60.constprop.68+0x314/0x354
[ 611.143985@3] [] kmem_cache_alloc_trace+0x188/0x1bc
[ 611.143993@3] [] fuse_alloc_forget+0x20/0x2c
[ 611.143997@3] [] fuse_lookup_name+0x64/0x1e4
[ 611.143999@3] [] fuse_lookup+0x34/0x104
[ 611.144006@3] [] lookup_real+0x3c/0x7c
[ 611.144009@3] [] __lookup_hash+0x50/0x6c
[ 611.144014@3] [] lookup_slow+0x48/0xfc
[ 611.144017@3] [] path_lookupat+0x678/0x790
[ 611.144021@3] [] filename_lookup.isra.30+0x38/0x9c
[ 611.144025@3] [] user_path_at_empty+0x60/0xb0
[ 611.144028@3] [] user_path_at+0x38/0x48
[ 611.144032@3] [] vfs_fstatat+0x68/0xc0
[ 611.144036@3] [] SyS_newfstatat+0x34/0x58
[ 611.144039@3] FIX kmalloc-64: Restoring 0xffffffc0115bb500-0xffffffc0115bb51f=0x6b
[ 611.144039@3]
[ 611.144042@3] FIX kmalloc-64: Marking all objects used