* Limits for ION Memory Allocator
@ 2019-07-17 16:31 Alexander Popov
2019-07-24 19:36 ` Laura Abbott
0 siblings, 1 reply; 2+ messages in thread
From: Alexander Popov @ 2019-07-17 16:31 UTC (permalink / raw)
To: Laura Abbott, Sumit Semwal, Greg Kroah-Hartman, arve, Todd Kjos,
Martijn Coenen, Joel Fernandes, Christian Brauner, Riley Andrews,
devel, linaro-mm-sig, linux-arm-kernel, dri-devel, LKML,
Brian Starkey, Daniel Vetter, Mark Brown, Benjamin Gaignard,
Linux-MM, Dmitry Vyukov, Andrey Konovalov, syzkaller
Hello!
The syzkaller [1] has a trouble with fuzzing the Linux kernel with ION Memory
Allocator.
Syzkaller uses several methods [2] to limit memory consumption of the userspace
processes calling the syscalls for testing the kernel:
- setrlimit(),
- cgroups,
- various sysctl.
But these methods don't work for ION Memory Allocator, so any userspace process
that has access to /dev/ion can bring the system to the out-of-memory state.
An example of a program doing that:
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <linux/types.h>
#include <sys/ioctl.h>
#define ION_IOC_MAGIC 'I'
#define ION_IOC_ALLOC _IOWR(ION_IOC_MAGIC, 0, \
struct ion_allocation_data)
struct ion_allocation_data {
__u64 len;
__u32 heap_id_mask;
__u32 flags;
__u32 fd;
__u32 unused;
};
int main(void)
{
unsigned long i = 0;
int fd = -1;
struct ion_allocation_data data = {
.len = 0x13f65d8c,
.heap_id_mask = 1,
.flags = 0,
.fd = -1,
.unused = 0
};
fd = open("/dev/ion", 0);
if (fd == -1) {
perror("[-] open /dev/ion");
return 1;
}
while (1) {
printf("iter %lu\n", i);
ioctl(fd, ION_IOC_ALLOC, &data);
i++;
}
return 0;
}
I looked through the code of ion_alloc() and didn't find any limit checks.
Is it currently possible to limit ION kernel allocations for some process?
If not, is it a right idea to do that?
Thanks!
Best regards,
Alexander
[1]: https://github.com/google/syzkaller
[2]: https://github.com/google/syzkaller/blob/master/executor/common_linux.h
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Limits for ION Memory Allocator
2019-07-17 16:31 Limits for ION Memory Allocator Alexander Popov
@ 2019-07-24 19:36 ` Laura Abbott
0 siblings, 0 replies; 2+ messages in thread
From: Laura Abbott @ 2019-07-24 19:36 UTC (permalink / raw)
To: alex.popov, Sumit Semwal, Greg Kroah-Hartman, arve, Todd Kjos,
Martijn Coenen, Joel Fernandes, Christian Brauner, Riley Andrews,
devel, linaro-mm-sig, linux-arm-kernel, dri-devel, LKML,
Brian Starkey, Daniel Vetter, Mark Brown, Benjamin Gaignard,
Linux-MM, Dmitry Vyukov, Andrey Konovalov, syzkaller,
John Stultz
On 7/17/19 12:31 PM, Alexander Popov wrote:
> Hello!
>
> The syzkaller [1] has a trouble with fuzzing the Linux kernel with ION Memory
> Allocator.
>
> Syzkaller uses several methods [2] to limit memory consumption of the userspace
> processes calling the syscalls for testing the kernel:
> - setrlimit(),
> - cgroups,
> - various sysctl.
> But these methods don't work for ION Memory Allocator, so any userspace process
> that has access to /dev/ion can bring the system to the out-of-memory state.
>
> An example of a program doing that:
>
>
> #include <sys/types.h>
> #include <sys/stat.h>
> #include <fcntl.h>
> #include <stdio.h>
> #include <linux/types.h>
> #include <sys/ioctl.h>
>
> #define ION_IOC_MAGIC 'I'
> #define ION_IOC_ALLOC _IOWR(ION_IOC_MAGIC, 0, \
> struct ion_allocation_data)
>
> struct ion_allocation_data {
> __u64 len;
> __u32 heap_id_mask;
> __u32 flags;
> __u32 fd;
> __u32 unused;
> };
>
> int main(void)
> {
> unsigned long i = 0;
> int fd = -1;
> struct ion_allocation_data data = {
> .len = 0x13f65d8c,
> .heap_id_mask = 1,
> .flags = 0,
> .fd = -1,
> .unused = 0
> };
>
> fd = open("/dev/ion", 0);
> if (fd == -1) {
> perror("[-] open /dev/ion");
> return 1;
> }
>
> while (1) {
> printf("iter %lu\n", i);
> ioctl(fd, ION_IOC_ALLOC, &data);
> i++;
> }
>
> return 0;
> }
>
>
> I looked through the code of ion_alloc() and didn't find any limit checks.
> Is it currently possible to limit ION kernel allocations for some process?
>
> If not, is it a right idea to do that?
> Thanks!
>
Yes, I do think that's the right approach. We're working on moving Ion
out of staging and this is something I mentioned to John Stultz. I don't
think we've thought too hard about how to do the actual limiting so
suggestions are welcome.
Thanks,
Laura
> Best regards,
> Alexander
>
>
> [1]: https://github.com/google/syzkaller
> [2]: https://github.com/google/syzkaller/blob/master/executor/common_linux.h
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-07-24 19:36 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-07-17 16:31 Limits for ION Memory Allocator Alexander Popov
2019-07-24 19:36 ` Laura Abbott
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).