App Control: Agent Kernel Module Fails to Allocate Large Amounts of Contiguous Memory

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Agent will hang, or crash due to large contiguous memory allocation failure when there is memory crunch on server
• 'b9daemon invoked oom-killer' messages similar to the following appear in the /var/log/messages file:

 kernel: b9daemon invoked oom-killer: gfp_mask=0x201da, order=0, oom_score_adj=0
 kernel: b9daemon cpuset=/ mems_allowed=0
 kernel: CPU: 6 PID: 6708 Comm: b9daemon Tainted: P OE ------------ 3.10.0-693.21.1.el7.x86_64 #1
 kernel: Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/05/2016
 kernel: Call Trace:
 kernel: [<ffffffff816ae7c8>] dump_stack+0x19/0x1b
 kernel: [<ffffffff816a9b90>] dump_header+0x90/0x229
 kernel: [<ffffffff810ecec2>] ? ktime_get_ts64+0x52/0xf0
 kernel: [<ffffffff8118a884>] oom_kill_process+0x254/0x3d0
 kernel: [<ffffffff8118a32d>] ? oom_unkillable_task+0xcd/0x120
 kernel: [<ffffffff8118a3d6>] ? find_lock_task_mm+0x56/0xc0
 kernel: [<ffffffff8118b0c6>] out_of_memory+0x4b6/0x4f0
 kernel: [<ffffffff816aa694>] __alloc_pages_slowpath+0x5d6/0x724
 kernel: [<ffffffff811912a5>] __alloc_pages_nodemask+0x405/0x420
 kernel: [<ffffffff811d5a38>] alloc_pages_current+0x98/0x110
 kernel: [<ffffffff81186da7>] __page_cache_alloc+0x97/0xb0
 kernel: [<ffffffff81189370>] filemap_fault+0x170/0x420
 kernel: [<ffffffffc022e1e6>] ext4_filemap_fault+0x36/0x50 [ext4]
 kernel: [<ffffffff811b19d8>] __do_fault+0x58/0xe0
 kernel: [<ffffffff810f89f8>] ? get_futex_key+0x1c8/0x2c0
 kernel: [<ffffffff811b1e7b>] do_read_fault.isra.44+0x4b/0x130
 kernel: [<ffffffff811b6781>] handle_mm_fault+0x691/0xfa0
 kernel: [<ffffffff810fb77a>] ? do_futex+0x12a/0x5a0
 kernel: [<ffffffff816bb504>] __do_page_fault+0x154/0x450
 kernel: [<ffffffff816bb835>] do_page_fault+0x35/0x90
 kernel: [<ffffffff816b7768>] page_fault+0x28/0x30

Environment

• App Control Agent: Version 8.7.6
• Red Hat Version 7 and 8

Cause

The 'b9k_*' kernel module may fail allocating large contiguous memory when there is high memory stress on the server.

Resolution

Addressed in Linux Agent version 8.7.10:  EP-16555: Fixed an issue where the App Control kernel module failed to allocate large amounts of contiguous memory