On Fri, Jun 26, 2026 at 08:52:02AM -0700, Breno Leitao wrote: > kmemleak reports an object the first scan it is found unreferenced. Its > mark phase runs without stopping the rest of the kernel and without a > write barrier, so a live object whose only reference is briefly invisible > during a concurrent RCU update -- e.g. a VMA moved between maple tree > nodes, or a page-cache xa_node -- can be seen as unreferenced for that one > scan. Because an object is flagged as reported only once, such a transient > race turns into a permanent false positive. > > Track how many consecutive scans each object has been seen unreferenced > and only report it once that reaches min_unref_scans, a new module > parameter. It defaults to 1, leaving the behaviour unchanged; setting it > higher (e.g. 2) still reports a genuine leak, one scan later, while an > object referenced again before the threshold restarts its run and is never > reported. > > min_unref_scans can be set at boot with kmemleak.min_unref_scans=<n> or at > run-time via /sys/module/kmemleak/parameters/min_unref_scans. > > Signed-off-by: Breno Leitao <[email protected]>
It looks like a good addition to me. All objects require a second pass initially to get their checksum updated but that's not sufficient when they are moved between nodes without having their content changed (list in a linked list). Reviewed-by: Catalin Marinas <[email protected]> > diff --git a/mm/kmemleak.c b/mm/kmemleak.c > index 7c7ba17ce7af0..5b14ccb36f95b 100644 > --- a/mm/kmemleak.c > +++ b/mm/kmemleak.c > @@ -151,6 +151,8 @@ struct kmemleak_object { > int min_count; > /* the total number of pointers found pointing to this object */ > int count; > + /* consecutive scans the object has been seen unreferenced */ > + unsigned int unref_scans; > /* checksum for detecting modified objects */ > u32 checksum; > depot_stack_handle_t trace_handle; > @@ -232,6 +234,9 @@ static unsigned long max_percpu_addr; > static struct task_struct *scan_thread; > /* used to avoid reporting of recently allocated objects */ > static unsigned long jiffies_min_age; > +/* consecutive scans an object must stay unreferenced before reporting */ > +static unsigned int min_unref_scans = 1; > +module_param(min_unref_scans, uint, 0644); 0644 is fine. Not sure why kmemleak_verbose was 0600. -- Catalin
