grsecurity forums

Posted: **Mon Nov 17, 2014 6:48 am**

I posted this message on the gentoo forums : https://forums.gentoo.org/viewtopic-t-1004206.html but since I found this post (viewtopic.php?f=3&t=2180), I believe this forum may be better suited because the problem seems similar except I don't have the nvidia module.

To summarize my problem, I cannot load the bridge module; log says "vmap allocation for size 233472 failed: use vmalloc=<size> to increase size" but changing this value doesn't help. You may find some more context and logs extract/command output in the original post.

Since the first post, I managed to load the bridge module by unloading a module, trying to load bridge and reloading the first module; one module after another until success. But this is not really an acceptable solution.

Posted: **Mon Nov 17, 2014 5:36 pm**

what is the PAX part of the kernel .config? in particular, is KERNEXEC enabled and if it is, what's CONFIG_PAX_KERNEXEC_MODULE_TEXT set to? also what does /proc/modules look like when you manage to load the modules?

Posted: **Wed Nov 19, 2014 6:55 am**

Code: Select all: # gunzip -c /proc/config.gz | grep -i pax CONFIG_PAX_USERCOPY_SLABS=y # PaX CONFIG_PAX=y # PaX Control # CONFIG_PAX_SOFTMODE is not set CONFIG_PAX_PT_PAX_FLAGS=y CONFIG_PAX_XATTR_PAX_FLAGS=y CONFIG_PAX_NO_ACL_FLAGS=y # CONFIG_PAX_HAVE_ACL_FLAGS is not set # CONFIG_PAX_HOOK_ACL_FLAGS is not set CONFIG_PAX_NOEXEC=y CONFIG_PAX_PAGEEXEC=y CONFIG_PAX_SEGMEXEC=y # CONFIG_PAX_EMUTRAMP is not set CONFIG_PAX_MPROTECT=y CONFIG_PAX_MPROTECT_COMPAT=y CONFIG_PAX_ELFRELOCS=y CONFIG_PAX_KERNEXEC=y CONFIG_PAX_KERNEXEC_PLUGIN_METHOD="" CONFIG_PAX_KERNEXEC_MODULE_TEXT=4 CONFIG_PAX_ASLR=y CONFIG_PAX_RANDKSTACK=y CONFIG_PAX_RANDUSTACK=y CONFIG_PAX_RANDMMAP=y CONFIG_PAX_MEMORY_SANITIZE=y CONFIG_PAX_MEMORY_STACKLEAK=y CONFIG_PAX_MEMORY_STRUCTLEAK=y CONFIG_PAX_MEMORY_UDEREF=y CONFIG_PAX_REFCOUNT=y CONFIG_PAX_CONSTIFY_PLUGIN=y CONFIG_PAX_USERCOPY=y # CONFIG_PAX_USERCOPY_DEBUG is not set CONFIG_PAX_SIZE_OVERFLOW=y CONFIG_PAX_LATENT_ENTROPY=y

So yes KERNEXEC is enabled and CONFIG_PAX_KERNEXEC_MODULE_TEXT is set to 4

/proc/modules :

Code: Select all: Module Size Used by nf_conntrack_sip 15441 0 nf_conntrack_h323 31467 0 nf_conntrack_sane 3512 0 nf_conntrack_pptp 3786 0 nf_conntrack_irc 3195 0 nf_conntrack_netbios_ns 1145 0 nf_conntrack_proto_gre 3836 1 nf_conntrack_pptp nf_conntrack_broadcast 1225 1 nf_conntrack_netbios_ns nf_conntrack_tftp 3241 0 nf_conntrack_netlink 23754 0 bridge 70994 0 stp 1513 1 bridge llc 3168 2 stp,bridge ipv6 242960 19 bridge coretemp 4544 0 ppdev 8490 0 iTCO_wdt 4299 0 iTCO_vendor_support 1760 1 iTCO_wdt video 10556 0 microcode 6362 0 drm_kms_helper 23677 0 drm 181919 1 drm_kms_helper processor 21317 0 thermal_sys 14523 2 video,processor i2c_i801 7661 0 pcspkr 1695 0 serio_raw 3725 0 lpc_ich 12028 0 parport_pc 24404 0 joydev 10552 0 mfd_core 2621 1 lpc_ich intel_agp 8200 0 intel_gtt 9066 2 intel_agp backlight 4274 1 video button 3789 0 agpgart 20837 3 drm,intel_agp,intel_gtt pata_acpi 2535 0 xts 2655 0 gf128mul 5538 1 xts cbc 2284 0 fuse 65009 1 xfs 603103 0 exportfs 3135 1 xfs nfs 120616 0 lockd 45968 1 nfs sunrpc 144190 2 nfs,lockd jfs 137014 0 ext4 369605 2 jbd2 60623 1 ext4 multipath 5084 0 linear 3819 0 raid10 37656 0 dm_snapshot 23680 0 dm_bufio 11573 1 dm_snapshot dm_crypt 13914 0 dm_mirror 10724 0 dm_region_hash 5887 1 dm_mirror dm_log 7206 2 dm_region_hash,dm_mirror dm_mod 64881 5 dm_log,dm_mirror,dm_bufio,dm_crypt,dm_snapshot hid_sunplus 1440 0 hid_sony 9265 0 led_class 2491 1 hid_sony hid_samsung 2673 0 hid_pl 1316 0 hid_petalynx 1849 0 hid_gyration 2007 0 sl811_hcd 10068 0 usbhid 31856 0 xhci_hcd 79212 0 ohci_hcd 22347 0 uhci_hcd 16701 0 usb_storage 33805 0 ehci_pci 2828 0 ehci_hcd 31869 1 ehci_pci usbcore 117881 8 uhci_hcd,usb_storage,ohci_hcd,ehci_hcd,ehci_pci,usbhid,xhci_hcd,sl811_hcd usb_common 1524 1 usbcore aic94xx 57089 0 libsas 50144 1 aic94xx lpfc 463938 0 crc_t10dif 1219 1 lpfc crct10dif_common 1456 1 crc_t10dif qla2xxx 429797 0 megaraid_sas 71664 0 megaraid_mbox 21564 0 megaraid_mm 8590 1 megaraid_mbox megaraid 31943 0 aacraid 64340 0 sx8 10162 0 DAC960 60826 0 cciss 87787 0 3w_9xxx 26006 0 3w_xxxx 20116 0 mptsas 39797 0 scsi_transport_sas 17863 3 libsas,mptsas,aic94xx mptfc 11165 0 scsi_transport_fc 32869 3 lpfc,qla2xxx,mptfc scsi_tgt 7472 1 scsi_transport_fc mptspi 12061 0 mptscsih 21642 3 mptfc,mptsas,mptspi mptbase 69570 4 mptfc,mptsas,mptspi,mptscsih atp870u 21062 0 dc395x 24101 0 qla1280 17407 0 imm 7633 0 parport 25107 3 imm,ppdev,parport_pc dmx3191d 8121 0 sym53c8xx 55812 0 qlogicfas408 4097 0 gdth 73636 0 advansys 42595 0 initio 13804 0 BusLogic 17359 0 arcmsr 21488 0 aic7xxx 93252 0 aic79xx 98349 0 scsi_transport_spi 16162 5 mptspi,sym53c8xx,aic79xx,aic7xxx,dmx3191d sg 24082 0 pdc_adma 4369 0 sata_inic162x 5657 0 sata_mv 19901 0 ata_piix 19362 4 ahci 20095 0 libahci 15807 1 ahci sata_qstor 4344 0 sata_vsc 3381 0 sata_uli 2496 0 sata_sis 3085 0 sata_sx4 7075 0 sata_nv 15050 0 sata_via 5723 0 sata_svw 3645 0 sata_sil24 8783 0 sata_sil 5931 0 sata_promise 7723 0 pata_pcmcia 7112 0 pcmcia 26380 1 pata_pcmcia pcmcia_core 9159 1 pcmcia

Posted: **Wed Nov 19, 2014 7:26 am**

that seems to be a lot of modules for 4MB. you should increase KERNEXEC_MODULE_TEXT and/or compile those modules into your kernel (since they get loaded every time, there's no point in keeping them out of vmlinux).

Posted: **Wed Nov 19, 2014 9:39 am**

Grsecurity's auto-configuration already had the limit bumped up to 12MB for desktop configs, but in the next patches I'll also bump up the server configs to use 8MB.

-Brad

grsecurity forums

modprobe cannot allocate memory "vmap allocation ... failed"

modprobe cannot allocate memory "vmap allocation ... failed"

Re: modprobe cannot allocate memory "vmap allocation ... fai

Re: modprobe cannot allocate memory "vmap allocation ... fai

Re: modprobe cannot allocate memory "vmap allocation ... fai

Re: modprobe cannot allocate memory "vmap allocation ... fai