Hello,
Recently, when playing with memory managment on linux I've found funny
DOS, based on lazy memory allocation in linux kernel.
Namely, let's take following simple code:
______________________________________________
#include <stdlib.h>
#include <stdio.h>
main(){
char* ptr;
long int count,i;
count = 150000000;
printf ("I'll alloc %ld bytes\n",count);
ptr = (char *) malloc(count);
if (ptr) printf("OK\n");
else {
printf("failed\n"); return;
}
for (i=0; i < count; i++) ptr[i] = i % 255;
}
________________________________________
on linux box with 200Mb of total(RAM+swap) memory (tested on 2.2.5 and
2.0.36).
Run it, and you'll see, with /usr/bin/top for example, that size of memory
for this process is growing, when you're writing to the memory.
All other *nix I've tested (Solaris, FreeBSD) behaves in another manner.
They allocate all memory when malloc'ing.
That's OK, lazy memory allocation and new technologies in action :).
But now, let's run 2 programs like this. Both mallocs will be succesfull,
but when memory will over, your linux became very unusable. You can't
start new processes, and some of existing processes will die. You should
reboot it, or run all needed from console (inetd, sshd will die too).
I think this is very nasty DOS, which can appear even in real life (
i.e. as result of working usual userspace programs, not this "exploit").
Please reply to me directly, as I not on the list.
Nikolay.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/
Recently, when playing with memory managment on linux I've found funny
DOS, based on lazy memory allocation in linux kernel.
Namely, let's take following simple code:
______________________________________________
#include <stdlib.h>
#include <stdio.h>
main(){
char* ptr;
long int count,i;
count = 150000000;
printf ("I'll alloc %ld bytes\n",count);
ptr = (char *) malloc(count);
if (ptr) printf("OK\n");
else {
printf("failed\n"); return;
}
for (i=0; i < count; i++) ptr[i] = i % 255;
}
________________________________________
on linux box with 200Mb of total(RAM+swap) memory (tested on 2.2.5 and
2.0.36).
Run it, and you'll see, with /usr/bin/top for example, that size of memory
for this process is growing, when you're writing to the memory.
All other *nix I've tested (Solaris, FreeBSD) behaves in another manner.
They allocate all memory when malloc'ing.
That's OK, lazy memory allocation and new technologies in action :).
But now, let's run 2 programs like this. Both mallocs will be succesfull,
but when memory will over, your linux became very unusable. You can't
start new processes, and some of existing processes will die. You should
reboot it, or run all needed from console (inetd, sshd will die too).
I think this is very nasty DOS, which can appear even in real life (
i.e. as result of working usual userspace programs, not this "exploit").
Please reply to me directly, as I not on the list.
Nikolay.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/