Why does running ps result in a "Cannot allocate memory" error?

Question

I am using Ubuntu 12.04 Server. After upgrading to kernel 3.2.0-38-generic, ps takes a long time and finally reports as:

xrealloc: realloc(-2147483648) failedCannot allocate memory

Booting with the previous kernel, 3.2.0-37-generic restores the normal behavior of ps.

The only clue I have is that it does not occur when I login with local user account but only when logging in with an authorized Windows AD account (samba/winbind setup).

Any ideas on how to resolve the issue?

Answer 1

I have had the same issue with ps since 12.04.2 updates were applied. We are using AD accounts, but with an LDAP setup.

I have not found a solution, but running an older kernel also stops the problem for me. What I've found is

• I get the ps error for any user when any process is owned by a remote user AND that user is a member of a large number of groups
• I do not get the error if the remote user has no more than 144 group memberships. 144 was the magic number on all four servers I tested, but could be affected by RAM available.
• I was able to duplicate the problem with local users, but it took more groups.
• On one server which had tons of RAM to allocate ps failed with the error "Signal 11 (SEGV) caught by ps (procps version 3.2.8)."

Here is part of an strace of ps run as root. It chokes when it hits the process owned by the user with lots of groups

stat("/proc/31182", {st_mode=S_IFDIR|0555, st_size=0, ...}) = 0
open("/proc/31182/stat", O_RDONLY)      = 6
read(6, "31182 (su) S 24612 31182 24612 34816 31183 4202752 644 0 6 0 0 0 0 0 20 0 1 0 34284825 60358656 481 18446744073709551615 4194304 4224060 140733222184144 140733222183392 140462670197822 0 2147196671 0 16384 18446744071579286484 0 0 17 0 0 0 0 0 0\n", 1023) = 246
close(6)                                = 0
open("/proc/31182/status", O_RDONLY)    = 6
read(6, "Name:\tsu\nState:\tS (sleeping)\nTgid:\t31182\nPid:\t31182\nPPid:\t24612\nTracerPid:\t0\nUid:\t1001\t1001\t1001\t1001\nGid:\t1351\t1351\t1351\t1351\nFDSize:\t256\nGroups:\t1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1", 1023) = 1023
close(6)                                = 0
mmap(NULL, 135168, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f806f2dd000
mremap(0x7f806f2dd000, 135168, 266240, MREMAP_MAYMOVE) = 0x7f806f29c000
mremap(0x7f806f29c000, 266240, 528384, MREMAP_MAYMOVE) = 0x7f806fd68000
mremap(0x7f806fd68000, 528384, 1052672, MREMAP_MAYMOVE) = 0x7f806fc67000
mremap(0x7f806fc67000, 1052672, 2101248, MREMAP_MAYMOVE) = 0x7f806f0fd000
mremap(0x7f806f0fd000, 2101248, 4198400, MREMAP_MAYMOVE) = 0x7f806ecfc000
mremap(0x7f806ecfc000, 4198400, 8392704, MREMAP_MAYMOVE) = 0x7f806e4fb000
mremap(0x7f806e4fb000, 8392704, 16781312, MREMAP_MAYMOVE) = 0x7f806d4fa000
mremap(0x7f806d4fa000, 16781312, 33558528, MREMAP_MAYMOVE) = 0x7f806b4f9000
mremap(0x7f806b4f9000, 33558528, 67112960, MREMAP_MAYMOVE) = 0x7f80674f8000
mremap(0x7f80674f8000, 67112960, 134221824, MREMAP_MAYMOVE) = 0x7f805f4f7000
mremap(0x7f805f4f7000, 134221824, 268439552, MREMAP_MAYMOVE) = 0x7f804f4f6000
mremap(0x7f804f4f6000, 268439552, 536875008, MREMAP_MAYMOVE) = 0x7f802f4f5000
mremap(0x7f802f4f5000, 536875008, 1073745920, MREMAP_MAYMOVE) = -1 EFAULT (Bad address)
mmap(NULL, 1073745920, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = -1 ENOMEM (Cannot allocate memory)
brk(0x40e45000)                         = 0xe3c000
mmap(NULL, 1073876992, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = -1 ENOMEM (Cannot allocate memory)
open("/sys/devices/system/cpu/online", O_RDONLY|O_CLOEXEC) = 6
read(6, "0\n", 8192)                    = 2
close(6)                                = 0
mmap(NULL, 134217728, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_NORESERVE, -1, 0) = 0x7f7fa74d3000
munmap(0x7f7fa74d3000, 11718656)        = 0
munmap(0x7f7fac000000, 55390208)        = 0
mprotect(0x7f7fa8000000, 135168, PROT_READ|PROT_WRITE) = 0
mmap(NULL, 1073745920, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = -1 ENOMEM (Cannot allocate memory)
write(2, "xrealloc: realloc(1073741824) failed", 36xrealloc: realloc(1073741824) failed) = 36
write(2, "Cannot allocate memory\n", 23Cannot allocate memory

I was able to duplicate the problem with just local users with these steps. The number of groups needed to break ps was larger, so it may be dependent on RAM in the server.

root@alowther-d02:~# for i in $(seq 180); do groupadd group$i ; done
root@alowther-d02:~# useradd user1
root@alowther-d02:~# su - user1 -c ps
No directory, logging in with HOME=/
  PID TTY          TIME CMD
 5182 pts/0    00:00:00 su
 5183 pts/0    00:00:00 sh
 5185 pts/0    00:00:00 ps
root@alowther-d02:~# for i in $(seq 180); do adduser user1 group$i; done > /dev/null
root@alowther-d02:~# su - user1 -c ps
xrealloc: realloc(1073741824) failedCannot allocate memory

I should probably file a bug report, but this question is the only thing I've found related to this problem.