[Bug 274968] rpc_clnt_create: The dg_cv variable uses absurdly too much memory

From: <bugzilla-noreply_at_freebsd.org>
Date: Wed, 08 Nov 2023 19:29:24 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=274968

            Bug ID: 274968
           Summary: rpc_clnt_create: The dg_cv variable uses absurdly too
                    much memory
           Product: Base System
           Version: 14.0-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: bin
          Assignee: bugs@FreeBSD.org
          Reporter: asomers@FreeBSD.org

The clng_dt_create function allocates global variables named dg_cv and
dg_fd_locks, which are then used by the rest of the routines in clnt_dg.c. 
They are never freed, and live for the life of the process.  These variables
are arrays indexed by file descriptor.  To ensure that they have enough space,
they are sized according to RLIMIT_NOFILE.  The problem is that resource limit
can be very, very, big.  On my production servers, it's autoscaled to 22608720.
 So any process that does _anything_ involving NIS must allocate 259 MiB just
for these variables.

The exact same mistake is made in clnt_vc.c, with the vc_fd_locks and vc_cv
variables.

These add up to about 984 MB for every sshd process on my system (I'm not sure
how 259 gets multiplied to 984, but valgrind --tool=massif does show that all
the memory is coming from clnt_dg_create).  A few hundred of those sshd
processes and my entire server falls over.  Even with sshd rate limiting, about
half of my server's physical RAM is used just for this one stupid array
variable.

Stupidly, it appears that there's no need for a huge array.  Instead, the
condvar could've been part of the CLIENT structure.

Even stupider, this variable _never_ gets used in some simple applications like
getgrouplist.  So we allocate it, fault in every page, and then never use it. 
:facepalm:

-- 
You are receiving this mail because:
You are the assignee for the bug.