Project

General

Profile

Actions

Bug #5781

closed

Task #5682: tracking: smb performance issues

smb: unbounded file chunk queuing after gap

Added by Victor Julien almost 2 years ago. Updated over 1 year ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Due to a logic error / missing logic in file tracker truncing, the post-GAP truncing didn't actually clear the stored out of order chunks or prevent new chunks for being stored. This could quickly exhaust every available memory.

The problem is mitigated by the max-read-queue-size setting, but this setting is not enabled by default.


Subtasks 1 (0 open1 closed)

Bug #5791: smb: unbounded file chunk queuing after gap (6.0.x backport)ClosedVictor JulienActions

Related issues 4 (1 open3 closed)

Related to Suricata - Optimization #5782: smb: set defaults for file chunk limitsClosedVictor JulienActions
Related to Suricata - Security #5700: SCRealloc of large chunk crashes SuricataClosedVictor JulienActions
Related to Suricata - Security #5703: smb: crash inside of streaming buffer Grow()ClosedVictor JulienActions
Related to Suricata - Bug #5363: Memory leak in rust SMB file trackerFeedbackOISF DevActions
Actions

Also available in: Atom PDF