linux-kernel - Re: Kernel memory leak?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 17 Jul 2006 20:28:57 +0200
From:	"Michal Piotrowski" <michal.k.k.piotrowski@...il.com>
To:	"Andreas Rieke" <andreas.rieke@....de>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: Kernel memory leak?

Hi Andreas,

On 17/07/06, Andreas Rieke <andreas.rieke@....de> wrote:
> Hi,
>
> after booting a machine, it runs well using about 300 M of 1 G physical
> RAM. However, the remaining RAM decreases day by day, and after 2 or 3
> weeks, the machine crashes because swapping takes too much time.
> However, all processes together take about 250 MBytes according to ps,
> thus I assume that the kernel takes the rest. free tells me in fact that
> much swap space is used an nearly no physical RAM is left.
>
> This behaviour has been seen on Red Hat Enterprise Linux 3 with a 2.4
> kernel and on SuSE Linux 10 with a 2.6.13-15-default kernel. There are
> no unusual things running on the machine, the main application is an
> apache web server with a PostgreSQL database.
>
> Is there any kernel support to detect where the memory has gone?

Yes, the kmemleak patches http://homepage.ntlworld.com/cmarinas/kmemleak/

> Is any kind of memory eating virus or worm known?
> Is it possible that processes request memory which is NOT considered in
> /proc or in the procps tools?
> Is it possible that processes are invisible in /proc or in the procps tools?

Yes - if you have a rootkit.

>
> Thanks in advance,
>
> Andreas

Regards,
Michal

-- 
Michal K. K. Piotrowski
LTG - Linux Testers Group
(http://www.stardust.webpages.pl/ltg/wiki/)
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/