linux-kernel - Re: [PATCH v1 net] netlink: Fix wraparounds of sk->sk_rmem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAHC9VhRDyiNnULse4yfi7=K27VFxpVxfnGdY-E2Y+21F7YOfxQ@mail.gmail.com>
Date: Fri, 15 Aug 2025 10:12:21 -0400
From: Paul Moore <paul@...l-moore.com>
To: "Heyne, Maximilian" <mheyne@...zon.de>
Cc: Kuniyuki Iwashima <kuniyu@...gle.com>, "David S. Miller" <davem@...emloft.net>, 
	Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, 
	Simon Horman <horms@...nel.org>, Kuniyuki Iwashima <kuni1840@...il.com>, 
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>, Jason Baron <jbaron@...mai.com>, 
	"Ahmed, Aaron" <aarnahmd@...zon.com>, "Kumar, Praveen" <pravkmr@...zon.de>, Eric Paris <eparis@...hat.com>, 
	"linux-audit@...hat.com" <linux-audit@...hat.com>, 
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v1 net] netlink: Fix wraparounds of sk->sk_rmem_alloc.

On Fri, Aug 15, 2025 at 6:00 AM Heyne, Maximilian <mheyne@...zon.de> wrote:
> On Wed, Aug 13, 2025 at 03:00:29PM -0400, Paul Moore wrote:

...

> > Hopefully that resolves the problem, Maximilian?
>
> sorry for the late reply. Just tested the commit yesterday and I can
> confirm that this fixes our issues.

Great, thanks for confirming that.

> > Normally the audit subsystem is reasonably robust when faced with
> > significant audit loads.  An example I use for testing is to enable
> > logging for *every* syscall (from the command line, don't make this
> > persist via the config file!) and then shutdown the system; the system
> > will obviously slow quite a bit under the absurd load, but it should
> > shutdown gracefully without any lockups.
>
> Thank you for suggesting this. Will add something like this to our
> internal testing.

I wish I could say I regularly stress the audit subsystem in that way,
but I typically only do that when I make a related change or happen to
notice something in a related subsystem which might have an impact.
Additional testing is always welcome!

> Do you know whether there is already some stress test
> that covers the audit subsystem ...

Aside from the manual test that I already mentioned, which is my
preferred mechanism for stressing the logging/queuing mechanism, there
are two (?) contributed stress tests in the audit-testsuite, but I
don't run them and I doubt anyone does on a regular basis (look in the
tests_manual directory).

* https://github.com/linux-audit/audit-testsuite

> ... or would have any selftest found this issue?

Not having looked at the root cause, as that work was done before I
dug into this thread, I honestly can't say.

-- 
paul-moore.com