{"id":39764376,"url":"https://github.com/tzussman/kmodleak","last_synced_at":"2026-01-18T11:43:44.281Z","repository":{"id":181329066,"uuid":"666590446","full_name":"tzussman/kmodleak","owner":"tzussman","description":"Track memory leaks for Linux kernel modules using eBPF","archived":false,"fork":false,"pushed_at":"2025-11-24T05:34:55.000Z","size":2034,"stargazers_count":45,"open_issues_count":5,"forks_count":1,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-11-27T23:33:23.662Z","etag":null,"topics":["ebpf","kernel-modules","linux","memory-leaks","monitoring","observability"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tzussman.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2023-07-14T23:39:29.000Z","updated_at":"2025-11-24T05:34:53.000Z","dependencies_parsed_at":"2024-06-24T06:32:51.023Z","dependency_job_id":"5dadace2-8c07-4530-ad34-33a897d579c8","html_url":"https://github.com/tzussman/kmodleak","commit_stats":null,"previous_names":["tzussman/kmodleak"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/tzussman/kmodleak","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tzussman%2Fkmodleak","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tzussman%2Fkmodleak/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tzussman%2Fkmodleak/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tzussman%2Fkmodleak/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tzussman","download_url":"https://codeload.github.com/tzussman/kmodleak/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tzussman%2Fkmodleak/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28535177,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-18T10:13:46.436Z","status":"ssl_error","status_checked_at":"2026-01-18T10:13:11.045Z","response_time":98,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ebpf","kernel-modules","linux","memory-leaks","monitoring","observability"],"created_at":"2026-01-18T11:43:44.189Z","updated_at":"2026-01-18T11:43:44.263Z","avatar_url":"https://github.com/tzussman.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# kmodleak\n\n[![Github Actions](https://github.com/tzussman/kmodleak/actions/workflows/build.yml/badge.svg)](https://github.com/tzussman/kmodleak/actions/workflows/build.yml)\n\n`kmodleak` is an eBPF tool for tracing Linux kernel module memory leaks.\nFor full functionality, it requires loading and unloading the target module\nwhile it is running. It does NOT load or unload modules itself. Once the module\nis unloaded, `kmodleak` will automatically terminate and display a summary of\nany detected memory leaks.\n\n#### Credits\n\n*The infrastructure in this repo was taken from\n[libbpf-bootstrap](https://github.com/libbpf/libbpf-bootstrap/).*\n*`kmodleak`'s design is inspired by and based on\n[`memleak`](https://github.com/iovisor/bcc/blob/master/libbpf-tools/memleak.c)\nfrom BCC.*\n*`kmodleak` was also inspired by [`KEDR`](https://github.com/euspectre/kedr) and\nis intended to serve as a lightweight replacement for its memory leak detector.*\n\n## Setup\n\n### Install Dependencies\n\nYou will need `clang` (at least v12 or later), `libelf` and `zlib` to build\nthe examples, package names may vary across distros.\n\nOn Ubuntu/Debian, you need:\n```shell\n$ apt install clang libelf1 libelf-dev zlib1g-dev\n```\n\nOn CentOS/Fedora, you need:\n```shell\n$ dnf install clang elfutils-libelf elfutils-libelf-devel zlib-devel\n```\n\nIf your distribution does not offer a recent enough version of `clang`, see\nthe automatic installation script at [apt.llvm.org](https://apt.llvm.org/).\n\n### Getting the source code\n\nDownload the git repository and check out submodules:\n```shell\n$ git clone --recurse-submodules https://github.com/tzussman/kmodleak\n```\n\n### Building\n\nMakefile build:\n\n```console\n$ git submodule update --init --recursive       # check out libbpf\n$ cd src\n$ make\n$ sudo ./kmodleak leak  # Module is loaded and unloaded by the user (not shown)\nusing page size: 4096\nTracing module memory allocs... Unload module (or hit Ctrl-C) to end\nmodule 'leak' loaded\nmodule 'leak' unloaded\n\n1 stacks with outstanding allocations:\n128 bytes in 1 allocations from stack\n        addr = 0xffff00008ba60f00 size = 128\n          0 [\u003cffff80000834df84\u003e] kmalloc_trace+0xf0\n          1 [\u003cffff80000834df84\u003e] kmalloc_trace+0xf0\n          2 [\u003cffff800032f2f060\u003e] leak_init+0x34\n          3 [\u003cffff800008074dd0\u003e] do_one_initcall+0x60\n          4 [\u003cffff8000081b3404\u003e] do_init_module+0x50\n          5 [\u003cffff8000081b5458\u003e] load_module+0x1cb8\n          6 [\u003cffff8000081b5c7c\u003e] __do_sys_finit_module+0xac\n          7 [\u003cffff8000081b5d88\u003e] __arm64_sys_finit_module+0x28\n          8 [\u003cffff800008089bd8\u003e] invoke_syscall+0x78\n          9 [\u003cffff800008089cac\u003e] el0_svc_common.constprop.0+0x4c\n         10 [\u003cffff800008089d88\u003e] do_el0_svc+0x34\n         11 [\u003cffff800008d03794\u003e] el0_svc+0x34\n         12 [\u003cffff800008d04cd4\u003e] el0t_64_sync_handler+0xf4\n         13 [\u003cffff800008071548\u003e] el0t_64_sync+0x18c\ndone\n```\n\n## Usage\n\n`kmodleak` monitors kernel module memory allocations and detects leaks. The typical workflow is:\n\n1. **Start kmodleak** - Run `kmodleak` with the module name you want to monitor\n2. **Load the module** - In another terminal, load your kernel module with `insmod`\n3. **Use the module** - Exercise your module's functionality  \n4. **Unload the module** - Remove the module with `rmmod`\n5. **View results** - `kmodleak` automatically exits and shows any detected leaks\n\n### Basic Example\n\n**Terminal 1** - Start monitoring:\n```console\n$ sudo ./kmodleak mymodule\nusing page size: 4096\nTracing module memory allocs... Unload module (or hit Ctrl-C) to end\n```\n\n**Terminal 2** - Load, use, and unload your module:\n```console\n$ sudo insmod mymodule.ko\n$ # Exercise your module's functionality\n$ sudo rmmod mymodule\n```\n\n**Terminal 1** - Results appear automatically:\n```console\nmodule 'mymodule' loaded\nmodule 'mymodule' unloaded\n\n1 stacks with outstanding allocations:\n128 bytes in 1 allocations from stack\n        addr = 0xffff00008ba60f00 size = 128\n          0 [\u003cffff80000834df84\u003e] kmalloc_trace+0xf0\n          1 [\u003cffff80000834df84\u003e] kmalloc_trace+0xf0\n          2 [\u003cffff800032f2f060\u003e] mymodule_init+0x34\n          ...\ndone\n```\n\nThe repository includes a couple sample modules for testing under the `mod`\ndirectory.\n\n### Installation\n\nTODO\n\n## Troubleshooting\n\nlibbpf debug logs are quite helpful to pinpoint the exact source of problems,\nso it's usually a good idea to look at them before starting to debug or\nposting question online.\n\nFor `./kmodleak`, run it in verbose mode (`-v`) to see libbpf debug logs:\n\n```console\n$ sudo ./kmodleak -v leak\nusing page size: 4096\nlibbpf: loading object 'kmodleak_bpf' from buffer\nlibbpf: elf: section(2) .symtab, size 2400, link 1, flags 0, type=2\nlibbpf: elf: section(3) .text, size 600, link 0, flags 6, type=1\nlibbpf: sec '.text': found program 'validate_stack' at insn offset 0 (0 bytes), code size 75 insns (600 bytes)\nlibbpf: elf: section(4) raw_tracepoint/module_load, size 808, link 0, flags 6, type=1\nlibbpf: sec 'raw_tracepoint/module_load': found program 'kmodleak__module_load' at insn offset 0 (0 bytes), code size 101 insns (808 bytes)\nlibbpf: elf: section(5) kretprobe/load_module, size 208, link 0, flags 6, type=1\n...\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftzussman%2Fkmodleak","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftzussman%2Fkmodleak","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftzussman%2Fkmodleak/lists"}