[gentoo-user] out of memory during emerge: possible relationship with "TCP:Treason uncloaked"?

[b.n.]

Hi,
It's a couple of times I see my system horribly die while I'm 
re-emerging xmame (because of having added the +joystick USE flag).

The system becomes rapidly (but not all of a sudden) extremly 
unresponsive: first XMMS begins to skip, then mouse begins to seriously 
lag... until all grinds to a halt. The rxvt terminal gave no sign of 
errors during compilation, it just stopped.

I hard rebooted one time, then I left my system on for a couple of days 
without any problem.
Then I re-tried emerging xmame and I found the system freezed again. It 
went later in compiling, but it didn't finish. This time I found this 
error in messages, just before of my hard reboot:

-----
Dec  5 18:39:38 voynich oom-killer: gfp_mask=0x1d2
Dec  5 18:39:38 voynich DMA per-cpu:
Dec  5 18:39:38 voynich cpu 0 hot: low 2, high 6, batch 1
Dec  5 18:39:38 voynich cpu 0 cold: low 0, high 2, batch 1
Dec  5 18:39:38 voynich Normal per-cpu:
Dec  5 18:39:38 voynich cpu 0 hot: low 62, high 186, batch 31
Dec  5 18:39:38 voynich cpu 0 cold: low 0, high 62, batch 31
Dec  5 18:39:38 voynich HighMem per-cpu: empty
Dec  5 18:39:38 voynich
Dec  5 18:39:38 voynich Free pages:        5096kB (0kB HighMem)
Dec  5 18:39:38 voynich Active:59302 inactive:59085 dirty:0 writeback:0 
unstable:0 free:1274 slab:4307 mapped:116741 pagetables:556
Dec  5 18:39:38 voynich DMA free:2068kB min:88kB low:108kB high:132kB 
active:5096kB inactive:3852kB present:16384kB pages_scanned:9646 
all_unreclaimable? yes
Dec  5 18:39:38 voynich lowmem_reserve[]: 0 495 495
Dec  5 18:39:38 voynich Normal free:3028kB min:2804kB low:3504kB 
high:4204kB active:232112kB inactive:232488kB present:507840kB 
pages_scanned:530600 all_unreclaimable? yes
Dec  5 18:39:38 voynich lowmem_reserve[]: 0 0 0
Dec  5 18:39:38 voynich HighMem free:0kB min:128kB low:160kB high:192kB 
active:0kB inactive:0kB present:0kB pages_scanned:0 all_unreclaimable? no
Dec  5 18:39:38 voynich lowmem_reserve[]: 0 0 0
Dec  5 18:39:38 voynich DMA: 1*4kB 0*8kB 1*16kB 0*32kB 0*64kB 0*128kB 
0*256kB 0*512kB 0*1024kB 1*2048kB 0*4096kB = 2068kB
Dec  5 18:39:38 voynich Normal: 51*4kB 7*8kB 7*16kB 1*32kB 1*64kB 
2*128kB 1*256kB 0*512kB 0*1024kB 1*2048kB 0*4096kB = 3028kB
Dec  5 18:39:38 voynich HighMem: empty
Dec  5 18:39:38 voynich Swap cache: add 409212, delete 409212, find 
86175/120838, race 0+1
Dec  5 18:39:38 voynich Free swap  = 0kB
Dec  5 18:39:38 voynich Total swap = 506008kB
Dec  5 18:39:38 voynich Out of Memory: Killed process 22118 (firefox-bin).
Dec  5 18:39:38 voynich Out of Memory: Killed process 22126 (firefox-bin).
Dec  5 18:39:38 voynich Out of Memory: Killed process 22127 (firefox-bin).
Dec  5 18:39:38 voynich Out of Memory: Killed process 22133 (firefox-bin).
Dec  5 18:39:38 voynich Out of Memory: Killed process 22154 (firefox-bin).

...then the silence, and my reboot.

Looking in the logs for a cause of this thing (that I have never seen 
happening in my year-old Gentoo box) I found these lines in the log, 4 
hours before the OOM crash:

------
Dec  3 14:45:30 voynich TCP: Treason uncloaked! Peer 
82.113.24.190:4662/59982 shrinks window 3213745620:3213748388. Repaired.
Dec  3 14:45:33 voynich TCP: Treason uncloaked! Peer 
82.113.24.190:4662/59982 shrinks window 3213745620:3213748388. Repaired.
Dec  3 14:45:38 voynich TCP: Treason uncloaked! Peer 
82.113.24.190:4662/59982 shrinks window 3213745620:3213748388. Repaired.
Dec  3 14:46:45 voynich TCP: Treason uncloaked! Peer 
82.113.24.190:4662/59982 shrinks window 3213798180:3213799068. Repaired.
Dec  3 14:46:48 voynich TCP: Treason uncloaked! Peer 
82.113.24.190:4662/59982 shrinks window 3213798180:3213799068. Repaired.
Dec  3 14:46:56 voynich TCP: Treason uncloaked! Peer 
82.113.24.190:4662/59982 shrinks window 3213798180:3213799068. Repaired.
Dec  3 14:50:01 voynich cron[24853]: (root) CMD (test -x 
/usr/sbin/run-crons && /usr/sbin/run-crons )
Dec  3 14:53:40 voynich TCP: Treason uncloaked! Peer 
82.113.24.190:4662/59982 shrinks window 3214065924:3214068396. Repaired.
-------

Just because of curiosity, I googled for this and I found a thread on 
the Debian mailing list:
http://lists.debian.org/debian-isp/2002/04/msg00192.html

"So it appears that someone is running some sort of "tar-pit" system 
that is
designed to keep sockets in a bad state and run you out of kernel memory."

The thread also says that probably such a DoS attack shouldn't be able 
to crash a Linux box... but I feel the coincidence quite suspect. I 
can't guess what else it can be, apart from the xmame compile horribly 
memory leaking, but why should it?

Grepping, I found here are other sporadic sequences of "Treason 
uncloaked" in my syslogs in the past, but no other one of an OOM.

In the meantime I'll try to compile something else to see if I can 
repeat the problem with other emerges...

Thanks,

m.
-- 
gentoo-user@g.o mailing list