System and method for finding kernel memory leaks
The invention provides a system and method for tracking memory information associated with dynamically loaded kernel modules with the help of a tracking system. The tracking system defines its own kernel memory allocation functions. Whenever, a dynamic kernel module is loaded/unloaded into/from the kernel space, these newly defined functions are called in response to kernel memory allocation/de-allocation requests from the kernel module. The newly defined functions are responsible for allocating and de-allocating kernel memory, as well as, keeping track of information relating to the kernel memory allocations/de-allocations. The tracked information may be used to identify the source of kernel memory leaks.
1. A method to find a kernel memory leak, the method comprising:
replacing an address associated with an existing kernel memory allocation function in a kernel space with a new address associated with a new kernel memory allocation function defined for a kernel module loaded in the kernel space;
performing an allocation function in the new address using the new kernel memory allocation function in response to receiving a kernel memory allocation request from the kernel module loaded in the kernel space;
storing information relating to the allocation function performed in the new address in the kernel space;
tracking the stored information relating to the allocation function performed in the new address, wherein tracking the stored information relating to the allocation function comprises determining whether a condition defined in a rule has been met; and
performing a predetermined function defined in the rule in response to determining that the condition has been met.
2. The method of claim 1 , wherein the stored information relating to the allocation function is stored in a data structure having one or more selected from: a module name field, a PID field, a flag field, a system call field, an interrupt number field, or a date/time field.
3. The method of claim 1 , wherein the information relating to the allocation function comprises one or more selected from: an identity for a kernel module that initiated the kernel memory allocation request, a system call number associated with the kernel memory allocation request, an interrupt number associated with the kernel memory allocation request, a date for the kernel memory allocation request, a time for the kernel memory allocation request, or a process name relating to the kernel memory allocation request.
4. The method of claim 1 , wherein the allocation function performed in the new address comprises allocating kernel memory in the new address or de-allocating kernel memory in the new address.
5. A system to find a kernel memory leak, the system comprising:
an address replacement module that replaces an address associated with an existing kernel memory allocation function in a kernel space with a new address associated with a new kernel memory allocation function defined for a kernel module loaded in the kernel space; and
a monitoring and controlling module that:
performs an allocation function in the new address using the new kernel memory allocation function in response to receiving a kernel memory allocation request from the kernel module loaded in the kernel space;
stores information relating to the allocation function performed in the new address in the kernel space;
tracks the stored information relating to the allocation function performed in the new address, wherein tracking the stored information relating to the allocation function comprises determining whether a condition defined in a rule has been met; and
performs a predetermined function defined in the rule in response to determining that the condition has been met.
6. The system of claim 5 , wherein the monitoring and controlling module stores the information relating to the allocation function in a data structure having one or more selected from: a module name field, a PID field, a flag field, a system call field, an interrupt number field, or a date/time field.
7. The system of claim 5 , wherein the information relating to the allocation function comprises one or more selected from: an identity for a kernel module that initiated the kernel memory allocation request, a system call number associated with the kernel memory allocation request, an interrupt number associated with the kernel memory allocation request, a date for the kernel memory allocation request, a time for the kernel memory allocation request, or a process name relating to the kernel memory allocation request.
8. The system of claim 5 , wherein the allocation function performed in the new address comprises allocating kernel memory in the new address or de-allocating kernel memory in the new address.
9. The system of claim 5 , further comprising an interface to display the information regarding the allocation function to a user.
10. A computer program product comprising:
a non-transitory computer readable storage medium comprising computer readable program code embodied therewith to find a kernel memory leak, the computer readable program code comprising:
computer readable program code configured to replace an address associated with an existing kernel memory allocation function in a kernel space with a new address associated with a new kernel memory allocation function defined for a kernel module loaded in the kernel space;
computer readable program code configured to perform an allocation function in the new address using the new kernel memory allocation function in response to receiving a kernel memory allocation request from the kernel module loaded in the kernel space;
computer readable program code configured to store information relating to the allocation function performed in the new address in the kernel space;
computer readable program code configured to track the stored information relating to the allocation function performed in the new address, wherein tracking the stored information relating to the allocation function comprises determining whether a condition defined in a rule has been met; and
computer readable program code configured to perform a predetermined function defined in the rule in response to determining that the condition has been met.
11. The computer program product of claim 10 , wherein the stored information relating to the allocation function is stored in a data structure having one or more selected from: a module name field, a PID field, a flag field, a system call field, an interrupt number field, or a date/time field.
12. The computer program product of claim 10 , wherein the information relating to the allocation function comprises one or more selected from: an identity for a kernel module that initiated the kernel memory allocation request, a system call number associated with the kernel memory allocation request, an interrupt number associated with the kernel memory allocation request, a date for the kernel memory allocation request, a time for the kernel memory allocation request, or a process name relating to the kernel memory allocation request.
13. The computer program product of claim 10 , wherein the allocation function performed in the new address is configured to allocate kernel memory in the new address or de-allocate kernel memory in the new address.
14. The computer program product of claim 10 , further comprising computer readable program code configured to provide an interface to display the information regarding the allocation function to a user.