SLUB DEBUG检测内存问题

打开内核功能

CONFIG_SLUB=y
CONFIG_SLUB_DEBUG=y


CONFIG_SLUB_DEBUG_ON=y

或者CONFIG_SLUB_DEBUG_ON=n时使用启动参数来打开debug功能，具体参数如下

slub_debug=<Debug-Options>       Enable options for all slabs
slub_debug=<Debug-Options>,<slab name>
				Enable options only for select slabs

Possible debug options are
	F		Sanity checks on (enables SLAB_DEBUG_FREE. Sorry
			SLAB legacy issues)
	Z		Red zoning
	P		Poisoning (object and padding)
	U		User tracking (free and alloc)
	T		Trace (please only use on single slabs)
	A		Toggle failslab filter mark for the cache
	O		Switch debugging off for caches that would have
			caused higher minimum slab orders
	-		Switch all debugging off (useful if the kernel is
			configured with CONFIG_SLUB_DEBUG_ON)

测试redzone 和use after free  代码

#include <linux/init.h>
     #include <linux/module.h>
     #include <linux/slab.h>
     #include <linux/delay.h>
     
    struct slab_obj{
        int aa; 
        int bb; 
        int cc; 
    };
     
     typedef struct slab_obj* slab_obj_t;
     
     slab_obj_t memblk=NULL;
     
     struct kmem_cache *myslabobj;
     
    static void mm_create(void){
        int *p; 
        myslabobj=kmem_cache_create("my_slab_obj",sizeof(struct slab_obj),0,SLAB_HWCACHE_ALIGN,NULL);
        memblk=kmem_cache_alloc(myslabobj,GFP_KERNEL);
        memblk->aa=0xabcd;
        memblk->bb=0x1234;
        memblk->cc=0x5678;
    
         p = &memblk->cc;  
         p++;  
         *p = 0x12345678;  
    
    
    
    
    }
     
    static void mm_destroy(void){
        kfree(memblk);
        memblk->aa=0xabcd;
        memblk->bb=0x1234;
        memblk->cc=0x8789;
        kmem_cache_destroy(myslabobj);
        //memblk->aa=0xabcd;
        //memblk->bb=0x1234;
        //memblk->cc=0x8789;
    
    }
     
    static int __init mmbug_init(void){
       mm_create();
        return 0;
   }
     
    static void __exit mmbug_exit(void){
        mm_destroy();
   }
     
     module_init(mmbug_init);
     module_exit(mmbug_exit);
     MODULE_LICENSE("GPL");
     

Makefile

        CROSS_COMPLE:=arm-linux-
        ARCH:=arm
        CC:=$(CROSS_COMPILE)gcc
        LD:=$(CROSS_COMPILE)ld
        
        obj-m:=slub.o
        module-objs:=slub.o
        KDIR:=/path-to-kernelsource/linux-3.10.x
        MAKE:=make
       default:
               $(MAKE) -C $(KDIR) SUBDIRS=$(PWD) modules
       clean:
               $(MAKE) -C $(KDIR) SUBDIRS=$(PWD) clean

之后insmod  rmmod，会有打印信息

~ # insmod ./slub.ko 
~ # rmmod slub
=============================================================================
BUG my_slab_obj (Tainted: G           O): Redzone overwritten
-----------------------------------------------------------------------------

Disabling lock debugging due to kernel taint
INFO: 0xc1f1200c-0xc1f1200f. First byte 0x78 instead of 0xcc
INFO: Allocated in 0xbf00203c age=782 cpu=0 pid=470
INFO: Slab 0xc0ec9240 objects=64 used=1 fp=0xc1f12fc0 flags=0x0080
INFO: Object 0xc1f12000 @offset=0 fp=0xc1f12040

Object c1f12000: cd ab 00 00 34 12 00 00 78 56 00 00              ....4...xV..
Redzone c1f1200c: 78 56 34 12                                      xV4.
Padding c1f12034: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a              ZZZZZZZZZZZZ
CPU: 0 PID: 473 Comm: rmmod Tainted: G    B      O 3.10.107 #40
Backtrace: 
[<c0011fe4>] (dump_backtrace+0x0/0x10c) from [<c00121f8>] (show_stack+0x18/0x1c)
 r6:00000001 r5:c1f12034 r4:c1e1f500 r3:00000000
[<c00121e0>] (show_stack+0x0/0x1c) from [<c02f1014>] (dump_stack+0x20/0x28)
[<c02f0ff4>] (dump_stack+0x0/0x28) from [<c00b4ac0>] (print_trailer+0x12c/0x1c4)
[<c00b4994>] (print_trailer+0x0/0x1c4) from [<c00b4c1c>] (check_bytes_and_report+0xc4/0x108)
 r7:c1e1f500 r6:c1f1200c r5:c1f12010 r4:000000cc
[<c00b4b58>] (check_bytes_and_report+0x0/0x108) from [<c00b4de0>] (check_object+0x180/0x25c)
[<c00b4c60>] (check_object+0x0/0x25c) from [<c02efd0c>] (free_debug_processing+0xdc/0x2d0)
 r9:c1f1e008 r8:bf000018 r7:c1e6ee40 r6:c0ec9240 r5:c1f12000
r4:c1e1f500
[<c02efc30>] (free_debug_processing+0x0/0x2d0) from [<c02f0724>] (__slab_free+0x3c/0x348)
[<c02f06e8>] (__slab_free+0x0/0x348) from [<c00b6a94>] (kfree+0x10c/0x160)
[<c00b6988>] (kfree+0x0/0x160) from [<bf000018>] (mmbug_exit+0x18/0x50 [slub])
[<bf000000>] (mmbug_exit+0x0/0x50 [slub]) from [<c005c3f4>] (SyS_delete_module+0x14c/0x218)
 r4:bf000080 r3:bf000000
[<c005c2a8>] (SyS_delete_module+0x0/0x218) from [<c000ece0>] (ret_fast_syscall+0x0/0x34)
 r7:00000081 r6:00000000 r5:bea77f67 r4:00000000
FIX my_slab_obj: Restoring 0xc1f1200c-0xc1f1200f=0xcc

=============================================================================
BUG my_slab_obj (Tainted: G    B      O): Redzone overwritten
-----------------------------------------------------------------------------

INFO: 0xc1f1200c-0xc1f1200f. First byte 0xcc instead of 0xbb
INFO: Allocated in 0xbf00203c age=785 cpu=0 pid=470
INFO: Slab 0xc0ec9240 objects=64 used=0 fp=0xc1f12000 flags=0x0080
INFO: Object 0xc1f12000 @offset=0 fp=0xc1f12fc0

Object c1f12000: cd ab 00 00 34 12 00 00 89 87 00 00              ....4.......
Redzone c1f1200c: cc cc cc cc                                      ....
Padding c1f12034: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a              ZZZZZZZZZZZZ
CPU: 0 PID: 473 Comm: rmmod Tainted: G    B      O 3.10.107 #40
Backtrace: 
[<c0011fe4>] (dump_backtrace+0x0/0x10c) from [<c00121f8>] (show_stack+0x18/0x1c)
 r6:00000001 r5:c1f12034 r4:c1e1f500 r3:00000000
[<c00121e0>] (show_stack+0x0/0x1c) from [<c02f1014>] (dump_stack+0x20/0x28)
[<c02f0ff4>] (dump_stack+0x0/0x28) from [<c00b4ac0>] (print_trailer+0x12c/0x1c4)
[<c00b4994>] (print_trailer+0x0/0x1c4) from [<c00b4c1c>] (check_bytes_and_report+0xc4/0x108)
 r7:c1e1f500 r6:c1f1200c r5:c1f12010 r4:000000bb
[<c00b4b58>] (check_bytes_and_report+0x0/0x108) from [<c00b4de0>] (check_object+0x180/0x25c)
[<c00b4c60>] (check_object+0x0/0x25c) from [<c00b5ce0>] (__free_slab+0x160/0x1c0)
 r9:c0e28980 r8:c1f12000 r7:c1e1f500 r6:00000000 r5:00000001
r4:c0ec9240
[<c00b5b80>] (__free_slab+0x0/0x1c0) from [<c00b5da4>] (discard_slab+0x64/0x7c)
[<c00b5d40>] (discard_slab+0x0/0x7c) from [<c00b76a8>] (free_partial+0x78/0x220)
 r5:c0ec9240 r4:c1e1f500
[<c00b7630>] (free_partial+0x0/0x220) from [<c00b7874>] (__kmem_cache_shutdown+0x24/0xac)
[<c00b7850>] (__kmem_cache_shutdown+0x0/0xac) from [<c0099824>] (kmem_cache_destroy+0x58/0xe4)
 r5:c0e43b50 r4:c1e1f500
[<c00997cc>] (kmem_cache_destroy+0x0/0xe4) from [<bf00003c>] (mmbug_exit+0x3c/0x50 [slub])
 r5:00000000 r4:bf0001ac
[<bf000000>] (mmbug_exit+0x0/0x50 [slub]) from [<c005c3f4>] (SyS_delete_module+0x14c/0x218)
 r4:bf000080 r3:bf000000
[<c005c2a8>] (SyS_delete_module+0x0/0x218) from [<c000ece0>] (ret_fast_syscall+0x0/0x34)
 r7:00000081 r6:00000000 r5:bea77f67 r4:00000000
FIX my_slab_obj: Restoring 0xc1f1200c-0xc1f1200f=0xbb

参考文章：

http://blog.csdn.net/qqzhangchang/article/details/8191242

http://www.wowotech.net/memory_management/427.html

Documentation\vm\slub.txt