init_module may pin a lot of memory if given a bogus size

[Thadeu Lima de Souza Cascardo]

When running stress-ng sysinval stressor, I got a panic from an unrecoverable OOM.

This happens because stress-ng will call init_module with a module length of INT_MAX and that will allocate that much memory with vmalloc, which is not accountable for the process. This memory is freed by using vfree right after that, but when you run 4 to 8 stressors on a VM with ~8GiB of RAM, that might trigger OOM and there will be no way to recover, causing a panic.

Using __GFP_RETRY_MAYFAIL for both init_module and kernel_read_file (called by finit_module), alleviates the problem, but does not solve it, as other allocators will trigger OOM.

Module loading is an operation that is considered trusted, so it will be hard to do many changes in that path, so we might consider not stressing the system like that in our testing.

Cascardo.

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1906447

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Colin Ian King (colin-king)]

I can make this particular system call test one that only gets enabled with the --pathological option

[Thadeu Lima de Souza Cascardo (cascardo)]

That sounds perfect for me, Colin. Glad I didn't try patching stress-ng, cause I wouldn't consider this solution.

Thanks a lot!
Cascardo.

[Colin Ian King (colin-king)]

Fix committed: https://kernel.ubuntu.com/git/cking/stress-ng.git/commit/?id=a35ee1078e5898a465b1f7930b25dca64b5f471f

[Colin Ian King (colin-king)]

And fix committed: https://kernel.ubuntu.com/git/ubuntu/autotest-client-tests.git/commit/?id=0bff5942f97e2c2681f1faff1c769a1b232d9114

[Launchpad Janitor (janitor)]

This bug was fixed in the package stress-ng - 0.12.00-1

---------------
stress-ng (0.12.00-1) unstable; urgency=medium

  * Makefile: bump version
  * stress-epoll: fix sanity check for an unexpected epoll_ctl success
  * stress-funccall: disable ALWAYS_INLINE for PCC
  * stress-inotify: add void argument, fixes pcc build warning
  * stress-epoll: fix pcc build warning
  * stress-close: add invalid flags call to close_range
  * core-shim: add flags field to close_range shim to match 5.10
    system call
  * stress-utime: voidify return using assignment and voidification
  * stress-stack: reduce scope of variable ret
  * stress-sock: clean up some cppcheck warnings
  * stress-mlock: put HAVE_MLOCKALL into a statement block
  * stress-affinity: add in missing voidification of ret
  * stress-brk: remove redundant return 0 statement
  * stress-pkey: limit pkey system call warning to just instance 0
  * core-helper: don't use getpwent for static stress-ng builds:
  * stress-stack: rename sz to mlock_sz to avoid variable shadowing
  * stress-pthread: remove duplicate declaration of ret to clean up
    build warning
  * stress-msg: rename variable i to j to avoid name shadowing warning
  * stress-prctl: remove redundant declaration of environ
  * stress-msg: clean up variable shadowing
  * stress-yield: workaround FreeBSD usleep bug
  * stress-timer: workaround duplicated timer_delete segfault in FreeBSD
  * stress-ng.h: make shim_unconstify_ptr a static inline helper
  * stress-link: cast getpid() return to int for %d format specifier
  * stress-open: only declare obsolete_futimesat when it is required
  * stress-mmap: voidify page_size if HAVE_MPROTECT is not defined
  * stress-access: declare variable j only if HAVE_FACCESSAT is defined
  * stress-sem-sysv: silently ignore failures on semctl commands
  * stress-sem-sysv: ensure 4th arg of semctl is zero when not used
  * stress-sem-sysv: fix zero semaphores case in GETALL semctl
  * stress-brk: don't exercise mlockall with MCL_FUTURE if it is not
    defined
  * Fix clobbering of errno by error message logging before reading errno
  * stress-sem-sysv: move scope of array sems
  * stress-poll: make tv_nsec out of range value a 32 bit value
  * stress-mmap: only use PROT_GROWSUP and PROT_GROWSDOWN if supported
  * Fix ~0ULL cast to void * build warnings on 32 bit builds
  * kernel-coverage: add --pathological for sysinval stress
  * syscalls: update work to do and recent changes
  * stress-vm-splice: add pipe to memory vmsplicing
  * stress-utime: exercise utime family of calls with invalid filenames
  * stress-sysinfo: fix build issues introduced by previous commit
  * stress-sysinfo: exercise ustat with invalid major/minor
  * stress-userfaultfd: exercise UFFDIO_WAKE
  * stress-ramfs: exercise umount with some invalid pathnames
  * stress-binderfs: exercise invalid umount calls
  * stress-hdd: exercise invalid ftruncate/truncate fd/filename
  * stress-hdd: exercise invalid ftruncate/truncate size
  * stress-timer: exercise duplicated timer_delete
  * stress-pthread: add tkill to shim and exercise it
  * stress-pthread: add tgkill to shim and exercise it
  * stress-sync-file: exercise 0 nbytes sy...