linux内核内存问题检测调试

最新推荐文章于 2023-06-16 11:21:14 发布

iLinuxUser

最新推荐文章于 2023-06-16 11:21:14 发布

阅读量2.6k

点赞数

分类专栏： LINUX内核文章标签：内核调试内存 linux kernel

本文链接：https://blog.csdn.net/u010481276/article/details/78960348

版权

LINUX内核专栏收录该内容

34 篇文章 5 订阅

订阅专栏

内存检测：
编译slabinfo，对应在内核源码tools/vm下

/*
 * Slabinfo: Tool to get reports about slabs
 *
 * (C) 2007 sgi, Christoph Lameter
 * (C) 2011 Linux Foundation, Christoph Lameter
 *
 * Compile with:
 *
 * gcc -o slabinfo slabinfo.c
 */

gcc -o slabinfo slabinfo.c
这里用交叉工具链编译

 aarch64-linux-gnu-gcc -static slabinfo.c -o slabinfo 
 要加-static编译成静态生成slabinfo推送到测试机linux中

用此工具要在内核commandline中添加slub_debug=PZ参数
确保

:/ # cat /proc/cmdline                                                     
rootfstype=ramfs init=/init console=ttyS0,115200 no_console_suspend slub_debug=PZ ea

访问已经释放的内存
重复释放已释放的内存
越界访问

在内核打开如下配置

打开内核选项：
CONFIG_SLUB_DEBUG_ON
CONFIG_SLUB_DEBUG
CONFIG_SLUB_STATS
CONFIG_SLUB

如下例子
重复释放已释放的内存

make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- menuconfig

#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/init.h>
#include <linux/slab.h>

static char* buf;

static void create_slue_err(void){
    buf = kmalloc(32,GFP_KERNEL);
    if(buf)  {
        memset(buf,0x00,32);
        kfree(buf);
        printk("%s\n","free buf" );
        kfree(buf);//重复释放内存
    }

    return;
}

static int __init my_test_init(void) {
    printk("init %s\n", "my_test_init 1");
    create_slue_err();
    printk("init %s\n", "my_test_init 2");
    return 0;
}

static void __exit my_test_exit(void) {
    printk("%s\n","my_test_exit" );
    return ;
}
MODULE_LICENSE("GPL");
module_init(my_test_init);
module_exit(my_test_exit);

nsmod  /storage/DEBC3331BC330395/slub_test.ko                                 <
[ 9592.583607@3] init my_test_init 1
[ 9592.583639@3] free buf
[ 9592.583654@3] =============================================================================
[ 9592.591910@3] BUG kmalloc-64 (Tainted: G           O): Object already free
[ 9592.598722@3] -----------------------------------------------------------------------------
[ 9592.598722@3] 
[ 9592.608641@3] Disabling lock debugging due to kernel taint
[ 9592.614085@3] INFO: Allocated in $x+0x3c/0x8c [slub_test] age=3 cpu=3 pid=10621
[ 9592.621328@3]        alloc_debug_processing+0x194/0x1a0
[ 9592.625979@3]        __slab_alloc.isra.60.constprop.68+0x314/0x354
[ 9592.631585@3]        kmem_cache_alloc_trace+0x188/0x1bc
[ 9592.636243@3]        $x+0x38/0x8c [slub_test]
[ 9592.640039@3]        do_one_initcall+0xd4/0x138
[ 9592.644007@3]        load_module+0x1420/0x1dbc
[ 9592.647886@3]        SyS_finit_module+0x80/0x90
[ 9592.651854@3]        cpu_switch_to+0x48/0x4c
[ 9592.655564@3] INFO: Freed in $x+0x50/0x8c [slub_test] age=7 cpu=3 pid=10621
[ 9592.662463@3]        free_debug_processing+0x1f4/0x310
[ 9592.667033@3]        __slab_free+0x268/0x3a8
[ 9592.670741@3]        kfree+0x200/0x238
[ 9592.673934@3]        $x+0x4c/0x8c [slub_test]
[ 9592.677728@3]        do_one_initcall+0xd4/0x138
[ 9592.681696@3]        load_module+0x1420/0x1dbc
[ 9592.685578@3]        SyS_finit_module+0x80/0x90
[ 9592.689544@3]        cpu_switch_to+0x48/0x4c
[ 9592.693254@3] INFO: Slab 0xffffff8040d4bb30 objects=18 used=14 fp=0xffffffc0267f28c0 flags=0x4081
[ 9592.702050@3] INFO: Object 0xffffffc0267f28c0 @offset=2240 fp=0xffffffc0267f3180
[ 9592.702050@3] 
[ 9592.711023@3] Bytes b4 ffffffc0267f28b0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[ 9592.720594@3] Object ffffffc0267f28c0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[ 9592.729995@3] Object ffffffc0267f28d0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[ 9592.739397@3] Object ffffffc0267f28e0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[ 9592.748798@3] Object ffffffc0267f28f0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5  kkkkkkkkkkkkkkk.
[ 9592.758199@3] Redzone ffffffc0267f2900: bb bb bb bb bb bb bb bb                          ........
[ 9592.766997@3] Padding ffffffc0267f2a40: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[ 9592.776484@3] Padding ffffffc0267f2a50: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[ 9592.785972@3] Padding ffffffc0267f2a60: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[ 9592.795459@3] Padding ffffffc0267f2a70: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[ 9592.804949@3] CPU: 3 PID: 10621 Comm: insmod Tainted: G    B      O 3.14.29 #3
[ 9592.812105@3] Call trace:
[ 9592.814695@3] [<ffffffc001089390>] dump_backtrace+0x0/0x144
[ 9592.820214@3] [<ffffffc0010894f0>] show_stack+0x1c/0x28
[ 9592.825391@3] [<ffffffc001b1d294>] dump_stack+0x74/0xb8
[ 9592.830564@3] [<ffffffc0011b1a34>] print_trailer+0x148/0x1d0
[ 9592.836170@3] [<ffffffc0011b334c>] free_debug_processing+0x2a0/0x310
[ 9592.842466@3] [<ffffffc0011b5144>] __slab_free+0x268/0x3a8
[ 9592.847899@3] [<ffffffc0011b5710>] kfree+0x200/0x238
[ 9592.852817@3] [<ffffffbffc058068>] $x+0x68/0x8c [slub_test]
[ 9592.858336@3] [<ffffffc0010816a4>] do_one_initcall+0xd4/0x138
[ 9592.864029@3] [<ffffffc00111baec>] load_module+0x1420/0x1dbc
[ 9592.869635@3] [<ffffffc00111c600>] SyS_finit_module+0x80/0x90
[ 9592.875487@3] FIX kmalloc-64: Object at 0xffffffc0267f28c0 not freed
[ 9592.881720@3] init my_test_init 2

越界访问

static void create_slue_err(void){
    buf = kmalloc(32,GFP_KERNEL);
    if(buf)  {
        memset(buf,0x00,100);
        kfree(buf);
/*      printk("%s\n","free buf" );
        kfree(buf);*/
    }

    return;
}

 insmod /storage/DEBC3331BC330395/slub_test_access_free_point1.ko      
[  383.873867@3] init my_test_init 1
[  383.873899@3] init my_test_init 2
p212:/ # slabinfo -v                                                           
[  388.548241@3] =============================================================================
[  388.550941@3] BUG kmalloc-64 (Tainted: G    B      O): Redzone overwritten
[  388.557746@3] -----------------------------------------------------------------------------
[  388.557746@3] 
[  388.567667@3] INFO: 0xffffffc0498700c0-0xffffffc0498700c7. First byte 0x0 instead of 0xcc
[  388.575775@3] INFO: Slab 0xffffff8041956680 objects=32 used=9 fp=0xffffffc049870980 flags=0x0081
[  388.584484@3] INFO: Object 0xffffffc049870080 @offset=128 fp=0x          (null)
[  388.584484@3] 
[  388.593370@3] Bytes b4 ffffffc049870070: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  388.602942@3] Object ffffffc049870080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[  388.612343@3] Object ffffffc049870090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[  388.621744@3] Object ffffffc0498700a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[  388.631145@3] Object ffffffc0498700b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[  388.640547@3] Redzone ffffffc0498700c0: 00 00 00 00 00 00 00 00                          ........
[  388.649344@3] Padding ffffffc0498700d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[  388.658832@3] Padding ffffffc0498700e0: 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ....ZZZZZZZZZZZZ
[  388.668319@3] Padding ffffffc0498700f0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  388.677810@3] CPU: 3 PID: 7181 Comm: slabinfo Tainted: G    B      O 3.14.29 #5
[  388.685051@3] Call trace:
[  388.687647@3] [<ffffffc001089390>] dump_backtrace+0x0/0x144
[  388.693161@3] [<ffffffc0010894f0>] show_stack+0x1c/0x28
[  388.698337@3] [<ffffffc001b1e854>] dump_stack+0x74/0xb8
[  388.703513@3] [<ffffffc0011b2420>] print_trailer+0x148/0x1d0
[  388.709117@3] [<ffffffc0011b2620>] check_bytes_and_report+0xec/0x124
[  388.715412@3] [<ffffffc0011b2810>] check_object+0x1b8/0x278
[  388.720933@3] [<ffffffc0011b3a60>] validate_slab_slab+0x1fc/0x24c
[  388.726969@3] [<ffffffc0011b684c>] validate_store+0xd0/0x1b4
[  388.732577@3] [<ffffffc0011b03a0>] slab_attr_store+0x40/0x60
[  388.738185@3] [<ffffffc001237ff4>] sysfs_kf_write+0x58/0x74
[  388.743704@3] [<ffffffc00123c300>] kernfs_fop_write+0xf8/0x154
[  388.749484@3] [<ffffffc0011c08e0>] vfs_write+0xac/0x198
[  388.754657@3] [<ffffffc0011c11cc>] SyS_write+0x50/0xb0
[  388.759745@3] FIX kmalloc-64: Restoring 0xffffffc0498700c0-0xffffffc0498700c7=0xcc
[  388.759745@3]

# uname -a                                                          
Linux localhost 3.14.29 #3 SMP PREEMPT Wed Jan 3 10:47:43 CST 2018 aarch64

访问已释放的内存

static void create_slue_err(void){
    buf = kmalloc(32,GFP_KERNEL);
    if(buf)  {
        /*memset(buf,0x00,33);*/
        kfree(buf);
        printk("%s\n","free buf" );
        /*kfree(buf);*/
        memset(buf,0x00,32);//访问已释放的内存
    }

    return;
}

orage/DEBC3331BC330395/slub_test_access_free_point.ko                         <
[  611.143223@1] init my_test_init 1
[  611.143255@1] free buf
[  611.143269@1] init my_test_init 2
[  611.143869@3] =============================================================================
[  611.143874@3] BUG kmalloc-64 (Tainted: G    B      O): Poison overwritten
[  611.143876@3] -----------------------------------------------------------------------------
[  611.143876@3] 
[  611.143882@3] INFO: 0xffffffc0115bb500-0xffffffc0115bb51f. First byte 0x0 instead of 0x6b
[  611.143887@3] INFO: Slab 0xffffff8040607848 objects=32 used=32 fp=0x          (null) flags=0x0080
[  611.143889@3] INFO: Object 0xffffffc0115bb500 @offset=1280 fp=0xffffffc0115bb900
[  611.143889@3] 
[  611.143895@3] Bytes b4 ffffffc0115bb4f0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  611.143898@3] Object ffffffc0115bb500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[  611.143900@3] Object ffffffc0115bb510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[  611.143903@3] Object ffffffc0115bb520: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
[  611.143906@3] Object ffffffc0115bb530: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5  kkkkkkkkkkkkkkk.
[  611.143908@3] Redzone ffffffc0115bb540: bb bb bb bb bb bb bb bb                          ........
[  611.143910@3] Padding ffffffc0115bb550: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  611.143913@3] Padding ffffffc0115bb560: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  611.143915@3] Padding ffffffc0115bb570: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[  611.143922@3] CPU: 3 PID: 7236 Comm: sdcard Tainted: G    B      O 3.14.29 #3
[  611.143925@3] Call trace:
[  611.143943@3] [<ffffffc001089390>] dump_backtrace+0x0/0x144
[  611.143947@3] [<ffffffc0010894f0>] show_stack+0x1c/0x28
[  611.143955@3] [<ffffffc001b1d294>] dump_stack+0x74/0xb8
[  611.143964@3] [<ffffffc0011b1a34>] print_trailer+0x148/0x1d0
[  611.143968@3] [<ffffffc0011b1c34>] check_bytes_and_report+0xec/0x124
[  611.143972@3] [<ffffffc0011b1e64>] check_object+0x1f8/0x278
[  611.143976@3] [<ffffffc0011b3d64>] alloc_debug_processing+0xbc/0x1a0
[  611.143981@3] [<ffffffc0011b4844>] __slab_alloc.isra.60.constprop.68+0x314/0x354
[  611.143985@3] [<ffffffc0011b4de8>] kmem_cache_alloc_trace+0x188/0x1bc
[  611.143993@3] [<ffffffc001377dcc>] fuse_alloc_forget+0x20/0x2c
[  611.143997@3] [<ffffffc0013709e4>] fuse_lookup_name+0x64/0x1e4
[  611.143999@3] [<ffffffc001370b98>] fuse_lookup+0x34/0x104
[  611.144006@3] [<ffffffc0011c94f0>] lookup_real+0x3c/0x7c
[  611.144009@3] [<ffffffc0011ca174>] __lookup_hash+0x50/0x6c
[  611.144014@3] [<ffffffc0011cade4>] lookup_slow+0x48/0xfc
[  611.144017@3] [<ffffffc0011ccc34>] path_lookupat+0x678/0x790
[  611.144021@3] [<ffffffc0011ccd84>] filename_lookup.isra.30+0x38/0x9c
[  611.144025@3] [<ffffffc0011cf9a0>] user_path_at_empty+0x60/0xb0
[  611.144028@3] [<ffffffc0011cfa28>] user_path_at+0x38/0x48
[  611.144032@3] [<ffffffc0011c42dc>] vfs_fstatat+0x68/0xc0
[  611.144036@3] [<ffffffc0011c4864>] SyS_newfstatat+0x34/0x58
[  611.144039@3] FIX kmalloc-64: Restoring 0xffffffc0115bb500-0xffffffc0115bb51f=0x6b
[  611.144039@3] 
[  611.144042@3] FIX kmalloc-64: Marking all objects used