Project

General

Profile

Actions
Copy link

Bug #5199

open
LS LS

flow/memcap: too low setting causes crash

Bug #5199: flow/memcap: too low setting causes crash

Added by Lukas Sismis over 4 years ago. Updated 2 months ago.

Status:
Assigned
Priority:
Normal
Assignee:
Lukas Sismis
Target version:
9.0.0-beta1
Affected Versions:
6.0.19, 8.0.1, 7.0.13, 9.0.0-beta1
Effort:
Difficulty:
Label:

Description

If I set flow.memcap low (10mb) then Suri starts to hog memory. Not stopping from doing so can result in a complete system crash/freeze. It seems like it bypasses some check and memory allocation gets into an infinite loop. For demonstration purposes, I am attaching a YAML file.
I've tried it with AF-PACKET capture mode but I believe this is not connected with any capture mode and thus it will be present in whatever capture mode.

Files

suricata.yaml (74.6 KB) suricata.yaml Lukas Sismis, 03/21/2022 10:06 AM

Subtasks 2 (1 open — 1 closed)

Bug #7926: flow/memcap: too low setting causes crash (8.0.x backport)AssignedLukas SismisActions
Bug #7927: flow/memcap: too low setting causes crash (7.0.x backport)RejectedActions

PA Updated by Philippe Antoine 10 months ago Actions
Copy link
 #1

Is this still the case in 8 ?
Could you describe more step by step how to reproduce ?

PA Updated by Philippe Antoine 10 months ago Actions
Copy link
 #2

  • Status changed from New to Feedback

LS Updated by Lukas Sismis 10 months ago Actions
Copy link
 #3

  • Status changed from Feedback to Assigned
  • Assignee changed from OISF Dev to Lukas Sismis
  • Target version changed from TBD to 9.0.0-beta1
  • Affected Versions 6.0.19, 8.0.1, 7.0.13, 9.0.0-beta1 added
  • Label Needs backport to 7.0, Needs backport to 8.0 added

yes, it is still present, will evaluate more.

OT Updated by OISF Ticketbot 10 months ago Actions
Copy link
 #4

  • Subtask #7926 added

OT Updated by OISF Ticketbot 10 months ago Actions
Copy link
 #5

  • Label deleted (Needs backport to 8.0)

OT Updated by OISF Ticketbot 10 months ago Actions
Copy link
 #6

  • Subtask #7927 added

OT Updated by OISF Ticketbot 10 months ago Actions
Copy link
 #7

  • Label deleted (Needs backport to 7.0)

LS Updated by Lukas Sismis 10 months ago Actions
Copy link
 #8

Could you describe more step by step how to reproduce ?

Just set flow memcap to 10mb, prealloc to 100k, and it starts consuming memory infinitely.

./src/suricata -c suricata.yaml -S /dev/null -l /tmp/ --af-packet=lo

SB Updated by Shivani Bhardwaj 8 months ago Actions
Copy link
 #9

  • Subject changed from Setting flow memcap too low tries to allocate the whole system memory to flow/memcap: too low setting causes crash
Actions
Copy link

Also available in: PDF Atom