kmalloc-xx slab leak observed in the system due to an issue with 'falcon_lsm_pinned_xxxx' module.
Issue
- The system is going into Out of memory situation due to slab usage growth.
- The issue has been observed after upgrading the system including falcon rpm as well.
-
Unreclaimable slab cache(kmalloc-xxx) usage keeps growing in the system.
# grep ^S /proc/meminfo | tail -3 Slab: 57003944 kB SReclaimable: 630612 kB SUnreclaim: 56373332 kB # cat /proc/slabinfo | awk '{printf " %6i MB %s \n",$6*$15/256,$1}' | sort -nrk1 | head 54941 MB kmalloc-16 180 MB xfs_inode 149 MB radix_tree_node 116 MB buffer_head 90 MB proc_inode_cache # cat /proc/slabinfo |awk '{printf "%7i MiB : %s\n",$6*$(NF-1)/256,$1}'|sort -nk 1 -r|head -5 114092 MiB : kmalloc-64 64526 MiB : kmalloc-16 138 MiB : acfs_inode_cache 95 MiB : acfs_buffer_cache_512 87 MiB : xfs_inode
Environment
- Red Hat Enterprise Linux.
- Crowdstrike Module -
falcon_lsm_pinned_xxxxx
.
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.