I've faced a situation on one of my VPSes where kernel slab memory spontaneously started leaking:
slabtop, I found the culprit to be
kmalloc-64. This is fairly meaningless, but after some searching I found you can add
slub_debug=U to the kernel command line. Then, you can see the source of slab allocs of this type by viewing
This pointed me to an issue with KVM paravirtualisation of page faults:
[20:48:53][root@kyubey][/sys/kernel/slab/kmalloc-64]# cat alloc_calls 27 x86_vector_alloc_irqs+0xf6/0x3b0 age=1061960/1062568/1063054 pid=0-92 15 mp_irqdomain_alloc+0x79/0x290 age=1063054/1063054/1063054 pid=0 138245 kvm_async_pf_task_wake+0x83/0x110 age=0/474464/1062430 pid=0-1517 31 reserve_memtype+0xb3/0x2c0 age=1060763/1062079/1063055 pid=0-273 24 __request_region+0x6e/0x190 age=1060825/1062237/1063050 pid=1-282 ...
My host has confirmed it is unlikely to be on their end, so I'm stumped as to where this came from out of the blue.
Anyway, a valid workaround is to add
no-kvmapf to the kernel command line.