#732393 tinc: strange memory error reported to syslog

Package:
tinc
Source:
tinc
Description:
Virtual Private Network daemon
Submitter:
Petter Reinholdtsen
Date:
2013-12-18 10:00:05 UTC
Severity:
normal
#732393#5
Date:
2013-12-17 15:39:37 UTC
From:
To:
Dear Maintainer,

I got some strang messages via syslog, which make me wonder if there is
some memory handling error in the code.  Here are some examples:

Dec 17 16:30:08 dugnadsnett t of memory [24322]
Dec 17 16:30:08 dugnadsnett t of memory [24322]
Dec 17 16:30:12 dugnadsnett tinc.dugnadsnett.no[24322]: Connection from 84.215.38.245 port 43850
Dec 17 16:30:12 dugnadsnett t of memory [24322]
Dec 17 16:30:12 dugnadsnett t of memory [24322]

I have no idea what could cause it, but thought it best to report the
problem in case it is a security issue.
#732393#10
Date:
2013-12-17 21:03:53 UTC
From:
To:
All allocations done by tinc itself are checked, and if one fails tinc will
immediately call abort(). However, there could of course be library functions
that do allocations that fail somehow.

I have googled for "t of memory", and found some reports from other Linux users
seeing the same messages in their syslog, but for other programs. I think the
likely culprit is the syslog() or vsyslog() function from glibc, since those
functions are responsible for formatting the lines that end up in the syslog.
Also, there is no string in tinc itself containing the text "(ou)t of memory".
On the other hand, one doesn't expect much memory to be allocated due to such
calls, and if that would fail you would expect tinc itself to quickly fail
afterwards.

Also, I wouldn't expect an amd64 to run out of memory from tinc. Can you check
whether memory really is tight?  And are you using tinc's mlock feature?
#732393#15
Date:
2013-12-18 05:02:14 UTC
From:
To:
[Guus Sliepen]

Well, my tincd process have failed a few times, as in disappeared
without a trace.  Did not find anything in the log explaining what
happened.

Memory isn't tight, I got 250 MiB free on the machine, according to
top.

I'm using the default, where --mlock is used as a command line option.
This is the command line according to ps -ef:

  /usr/sbin/tincd -n dugnadsnett.no -o Interface vpn -d1 --mlock --user=nobody
#732393#20
Date:
2013-12-18 09:22:33 UTC
From:
To:
Ok, that could be the result of tinc running out of memory.
process limits might prevent tinc from allocating all the locked memory it
needs. There is a patch available as well. Could you try it out and see if that
helps?

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=690685
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=20;filename=tinc-set-shell-limit.diff;att=1;bug=690685

After applying the patch, add the following to /etc/defaults/tinc:

LIMITS="-l unlimited"

I'll apply the patch to the version in unstable in any case.
#732393#25
Date:
2013-12-18 09:50:15 UTC
From:
To:
[Guus Sliepen]

Right.

It will not help, as I start tinc using ifup based on setup in
/etc/network/interfaces, and not using /etc/init.d/tinc.  I added
'ulimit -l 1024' in /etc/default/tinc instead to see if it help.

Not quite sure what is a good value.  Will try unlimited if 1024 is
too small. :)
#732393#30
Date:
2013-12-18 09:58:15 UTC
From:
To:
Oh, you're right, the patch doesn't cover ifup. Putting the ulimit command in
/etc/default/tinc should work. The package in experimental does it right though :)