Subject: RE: [hackers-il] We had computer viruses. Now tumors?

From: Chen Shapira <[email-masked]>
Date: Mon, 25 Mar 2002 18:45:33 +0200

> This antedote really works. If you manage to get a shell running, that
> is ;) On my computer it "won" in about a minute.

I'm not sure why it works...

A sleeping thread should be taking about 0 resources, no? (I think I
understood this from Steven's Advanced Unix)
And I don't think that the number of running processes is in any way limited
(except by resources).

So why would a bunch of sleeping processes bother anything?

---

From: mulix <[email-masked]>
Date: Mon, 25 Mar 2002 18:48:41 +0200

> understood this from Steven's Advanced Unix)

nope. for each process, there exist certain kernel data strcuture
(struct task_struct, for example). the number of these is limited, so
once the kernel runs out of them, no new process can be spawned. i
assume nadav's "cure" relies on this to stop the fork bomb. 
-- 
The ill-formed Orange
Fails to satisfy the eye:       http://vipe.technion.ac.il/~mulix/
Segmentation fault.             http://syscalltrack.sf.net/

---

From: "Nadav Har'El" <[email-masked]>
Date: Mon, 25 Mar 2002 18:55:50 +0200

> And I don't think that the number of running processes is in any way limited

Even a sleep process takes up resources, such as memory.
On modern systems with shared libraries and bloated programs, even "simple"
programs tend to take up a lot of memory. Do "sleep 1000&" and then do a
cat /proc/<process-number>/status. On my system I see:
	VmSize:     1868 kB
	VmLck:         0 kB
	VmRSS:       620 kB
	VmData:       64 kB
	VmStk:        20 kB
	VmExe:        12 kB
	VmLib:      1528 kB
I'm not sure what that means exactly, and which parts of that are shared
between different sleeps, but probably at least some of it is not shared.

But actually, the thing that makes this cure works is the fact that there
*is* a limit to the number of a running processes. There's a per-user limit
that you can view or set with "ulimit -u" (on my Linux machine, it's 511,
but I also have a lot of processes already running when these bombs started
their fight).
If I remember correctly, there's also a system-wide limit to the number of
processes in Linux, in
/proc/sys/kernel/threads-max.

-- 
Nadav Har'El                        |       Monday, Mar 25 2002, 13 Nisan 5762
[email-masked]             |-----------------------------------------
Phone: +972-53-245868, ICQ 13349191 |An egotist is a person of low taste, more
http://nadav.harel.org.il           |interested in himself than in me.