linux-kernel - Re: USBFS Memory allocation Bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 10 Mar 2010 10:33:32 +0100
From:	Markus Rechberger <mrechberger@...il.com>
To:	Alan Stern <stern@...land.harvard.edu>
Cc:	LKML <linux-kernel@...r.kernel.org>, Greg KH <greg@...ah.com>
Subject: Re: USBFS Memory allocation Bug

On Wed, Mar 10, 2010 at 4:13 AM, Alan Stern <stern@...land.harvard.edu> wrote:
> On Wed, 10 Mar 2010, Markus Rechberger wrote:
>
>> On Tue, Mar 9, 2010 at 11:31 PM, Alan Stern <stern@...land.harvard.edu> wrote:
>> > On Tue, 9 Mar 2010, Markus Rechberger wrote:
>> >
>> >> Hi,
>> >>
>> >> I just stumbled around following issue:
>> >>
>> >> [275835.163502] Pid: 14298, comm: mediasrv Not tainted 2.6.33 #7
>> >> [275835.163505] Call Trace:
>> >> [275835.163514]  [<ffffffff810df7a6>] __alloc_pages_nodemask+0x5b6/0x700
>> >> [275835.163520]  [<ffffffff8110c667>] alloc_pages_current+0x87/0xd0
>> >> [275835.163525]  [<ffffffff810dcf79>] __get_free_pages+0x9/0x50
>> >> [275835.163529]  [<ffffffff81114f2b>] __kmalloc+0x13b/0x1f0
>> >> [275835.163535]  [<ffffffff813a18ef>] proc_do_submiturb+0x2ff/0x9d0
>> >> [275835.163539]  [<ffffffff813a26b9>] usbdev_do_ioctl+0x6f9/0x14a0
>> >
>> > The mediasrv program tried to allocate more memory than was available.
>> > It's unfortunate but it's not a bug.
>> >
>>
>> Yes, 'unfortunate' is what bothers me about this, it can only be
>> around 198kbyte what the app can try to request (everything else will
>> fail internally).
>> The system has 4 gig ram, around 1 gig was not allocated (according to
>> free). not sure but I guess the pool where kmalloc tried to get the
>> memory from was out of memory, at least the OOM manager was not active
>> at all either and the rest of the system was more or less running
>> smoothly at this time.
>
> I suppose it's barely possible that even though 1 GB of memory was
> free, there was too much fragmentation to allocate a contiguous 198 KB
> buffer.  But that seems rather unlikely (unless your machine had been
> up for a very long time).
>
> At any rate, clearly the bug, if there is one, lies in the memory
> management subsystem and not in usbfs.
>

seems like yes, but the final result of this is that mediasrv was not
killable anymore.
Shouldn't the syscall just fail if this happens?

Markus

> Alan Stern
>
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/