Alibaba Cloud Linux:Detect kernel memory pollution with KFENCE

Add the kfence.sample_interval boot parameter. Replace <sample-interval> with the sampling interval in milliseconds. For example, 100 = every 100 ms.

   sudo grubby --update-kernel=/boot/vmlinuz-$(uname -r) --args="kfence.sample_interval=<sample-interval>"

(Optional) Add the kfence.booting_max parameter to cap KFENCE memory based on total system memory. Replace <booting-max> with a segment notation string such as 0-128M:0,128M-256M:1M,256M-:2M.

   sudo grubby --update-kernel=/boot/vmlinuz-$(uname -r) --args="kfence.booting_max=<booting-max>"

Restart the operating system for the configuration to take effect. Restart an instance.

Create a script named kfence.sh. The script counts active slab objects, sizes the pool, disables monitoring for other slabs and order-0 pages, then enables full-mode monitoring for the specified slabs.

   #!/bin/bash
   # usage: ./kfence.sh kmalloc-64

   SLAB_PREFIX=/sys/kernel/slab
   MODULE_PREFIX=/sys/module/kfence/parameters

   if [ $# -eq 0 ]; then
   	echo "err: please input slabs"
   	exit 1
   fi

   #check whether slab exists
   for i in $@; do
   	slab_path=$SLAB_PREFIX/$i
   	if [ !  -d $slab_path ]; then
   		echo "err: slab $i not exist!"
   		exit 1
   	fi
   done

   #calculate num_objects
   sumobj=0
   for i in $@; do
   	objects=($(cat $SLAB_PREFIX/$i/objects))
   	maxobj=1
   	for ((j=1; j<${#objects[@]}; j++)); do
   		nodeobj=$(echo ${objects[$j]} | awk -F= '{print $2}')
   		[ $maxobj -lt $nodeobj ] && maxobj=$nodeobj
   	done
   	((sumobj += maxobj))
   done
   echo "recommend num_objects per node: $sumobj"

   #check kfence stats
   if [ $(cat $MODULE_PREFIX/sample_interval) -ne 0 ]; then
   	echo "kfence is running, disable it and wait..."
   	echo 0 > $MODULE_PREFIX/sample_interval
   	sleep 1
   fi

   #disable all slabs catching
   for file in $SLAB_PREFIX/*
   do
   	(echo 0 > $file/kfence_enable) 2>/dev/null || echo 1 > $file/skip_kfence
   done

   #disable order0 page catching
   echo 0 > $MODULE_PREFIX/order0_page

   #enable setting slabs catching
   for i in $@; do
   	(echo 1 > $SLAB_PREFIX/$i/kfence_enable) 2>/dev/null || echo 0 > $SLAB_PREFIX/$i/skip_kfence
   done

   #setting num_objects and node mode
   echo $sumobj > $MODULE_PREFIX/num_objects
   echo node > $MODULE_PREFIX/pool_mode

   #start kfence
   echo -1 > $MODULE_PREFIX/sample_interval
   if [ $?  -ne 0 ]; then
   	echo "err: kfence enable fail!"
   	exit 1
   fi
   echo "kfence enabled!"

Run the script with the slab type to monitor:

   sudo bash ./kfence.sh kmalloc-64