Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

App Control: Agent Kernel Module Fails to Allocate Large Amounts of Contiguous Memory

App Control: Agent Kernel Module Fails to Allocate Large Amounts of Contiguous Memory

Environment

  • App Control Agent: Version 8.7.6
  • Red Hat Version 7 and 8

Symptoms

  • Agent will hang, or crash due to large contiguous memory allocation failure when there is memory crunch on server
  • 'b9daemon invoked oom-killer' messages similar to the following appear in the /var/log/messages file:
 kernel: b9daemon invoked oom-killer: gfp_mask=0x201da, order=0, oom_score_adj=0
 kernel: b9daemon cpuset=/ mems_allowed=0
 kernel: CPU: 6 PID: 6708 Comm: b9daemon Tainted: P OE ------------ 3.10.0-693.21.1.el7.x86_64 #1
 kernel: Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/05/2016
 kernel: Call Trace:
 kernel: [<ffffffff816ae7c8>] dump_stack+0x19/0x1b
 kernel: [<ffffffff816a9b90>] dump_header+0x90/0x229
 kernel: [<ffffffff810ecec2>] ? ktime_get_ts64+0x52/0xf0
 kernel: [<ffffffff8118a884>] oom_kill_process+0x254/0x3d0
 kernel: [<ffffffff8118a32d>] ? oom_unkillable_task+0xcd/0x120
 kernel: [<ffffffff8118a3d6>] ? find_lock_task_mm+0x56/0xc0
 kernel: [<ffffffff8118b0c6>] out_of_memory+0x4b6/0x4f0
 kernel: [<ffffffff816aa694>] __alloc_pages_slowpath+0x5d6/0x724
 kernel: [<ffffffff811912a5>] __alloc_pages_nodemask+0x405/0x420
 kernel: [<ffffffff811d5a38>] alloc_pages_current+0x98/0x110
 kernel: [<ffffffff81186da7>] __page_cache_alloc+0x97/0xb0
 kernel: [<ffffffff81189370>] filemap_fault+0x170/0x420
 kernel: [<ffffffffc022e1e6>] ext4_filemap_fault+0x36/0x50 [ext4]
 kernel: [<ffffffff811b19d8>] __do_fault+0x58/0xe0
 kernel: [<ffffffff810f89f8>] ? get_futex_key+0x1c8/0x2c0
 kernel: [<ffffffff811b1e7b>] do_read_fault.isra.44+0x4b/0x130
 kernel: [<ffffffff811b6781>] handle_mm_fault+0x691/0xfa0
 kernel: [<ffffffff810fb77a>] ? do_futex+0x12a/0x5a0
 kernel: [<ffffffff816bb504>] __do_page_fault+0x154/0x450
 kernel: [<ffffffff816bb835>] do_page_fault+0x35/0x90
 kernel: [<ffffffff816b7768>] page_fault+0x28/0x30

Cause

The 'b9k_*' kernel module may fail allocating large contiguous memory when there is high memory stress on the server.

Resolution

Addressed in Linux Agent version 8.7.10:  EP-16555: Fixed an issue where the App Control kernel module failed to allocate large amounts of contiguous memory

Related Content


Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎01-18-2023
Views:
184
Contributors