msync failure when adding a newsgroup

[Julien-Elie]

Reported by Chris Knipe in the inn-workers mailing-list.

When adding groups (ctlinnd newgroup), the following occurs:

2025-06-12T14:14:57.572314+02:00 nntpspool innd: SERVER msync failed /var/lib/news/active 0x0x7f3f46800000 5062656 Cannot allocate memory
2025-06-12T14:14:57.572335+02:00 nntpspool innd: CNFS: CNFSshutdowncycbuff: flushing 0
2025-06-12T14:14:57.594777+02:00 nntpspool systemd[1]: inn2.service: Main process exited, code=exited, status=1/FAILURE

INN refuses to start up, until I literally remove 1 line from my active file. As soon as I add them again, the issue reoccurs. The name of the group being added/removed is of no consequence.

root@nntpspool ~ # cat /var/lib/news/active|wc -l
107411

INN is using about 4GB RAM, the server has 128GB.

[Julien-Elie]

Investigation by Richard Kettlewell:

char *start = (char *) ((uintptr_t) p & mask);
char *end = (char *) (((uintptr_t) p + length + pagesize) & mask);

Assuming the page size is 4096 bytes:

• p = 0x7f3f46800000 is already page-aligned so start = p
• length = 5062656 is a multiple of 4096,
  so we will get end = p + length + 4096,
  given end-start = length+4096.

The effect is that INN will attempt to msync 4096 bytes beyond the end of the mapping.

In https://man7.org/linux/man-pages/man2/msync.2.html doing this is documented as being an error. The error code is consistent with the log message:

   ENOMEM The indicated memory (or part of it) was not mapped.

If length % 4096 > 0 then the effect would just be to round up to an exact number of pages, avoiding the error. So we'd expect to see the error in 1/4096 (about 0.025%) of possible active files sizes.

Anyway I think it should be:

char *end = (char *) (((uintptr_t) p + length + pagesize - 1) & mask);

...so that we end up to the round of the allocation, and never any further.