grsecurity forums

The RSS of many of my processes seems to be made from Numbers from Space(tm).
e.g.
root 281 0.0 99.9 2472 4294967268 ? S Oct08 0:00 supervise qmail-send
dnslog 295 0.0 99.9 2492 4294967232 ? S Oct08 0:00 multilog t ./main
and others with similar large numbers. All other values seem to be fine, and all the processes seem to work perfectly =)

Any guesses? I've not noticed it before but I have no idea when it started because I rarely use ps -u.

Torne

torne wrote:The RSS of many of my processes seems to be made from Numbers from Space(tm).

ps probably relies on the /proc filesystem to get process memory usage info and if you have /proc restrictions on, it may very well fail to get it and reports instead the error code returned by some C library function.

There seems to be no pattern to which processes have correct RSS values and which are negative, though..

I have all proc restrictions turned on but am running ps as root, so should be able to read them. Some of the processes with almost-4GB RSS values are running as root, one as qmaill. Curiously, all the mysql processes have a 3.99gb RSS. Other instances of the same program (supervise) are not all the same, even when running as the same user - some have sensible values, some not.

Torne

torne wrote:There seems to be no pattern to which processes have correct RSS values and which are negative, though..

can you try the latest procps/ps at http://procps.sourceforge.net/ and see what that produces?

The output is the same. Looking in /proc/pid/status:
Name: mysqld
State: S (sleeping)
Tgid: 26026
Pid: 26026
PPid: 246
TracerPid: 0
Uid: 102 102 102 102
Gid: 106 106 106 106
FDSize: 32
Groups: 106
VmSize: 28300 kB
VmLck: 0 kB
VmRSS: 4294966152 kB
VmData: 22900 kB
VmStk: 24 kB
VmExe: 3280 kB
VmLib: 1772 kB
SigPnd: 0000000000000000
SigBlk: 0000000080085005
SigIgn: 8000000000001000
SigCgt: 000000038008644f
CapInh: 0000000000000000
CapPrm: 0000000000000000
CapEff: 0000000000000000

So it's being reported by the kernel.

I'm using grsecurity-1.9.7 with most options enabled.

Torne

torne wrote:So it's being reported by the kernel.

so it's my bug, as usual.... sorry . the rss calculation for mirrored regions is wrong (non-existent ;P), i'll fix it. the numbers you see depend on how much of the given process has been swapped out/in over time, for every such page rss gets decreased by 1...

Okay, thanks =) Glad my system isn't going nuts =)

Torne

Is this fixed in current CVS?

torne wrote:Is this fixed in current CVS?

since the 13th or so

http://cvsweb.grsecurity.net/index.cgi/ ... m/memory.c