Re: fork() memory corruption... is this glibc2 or kernel?

Andrea Arcangeli (arcangeli@mbox.queen.it)
Sun, 21 Jun 1998 16:22:50 +0200 (CEST)


On Sun, 21 Jun 1998, MOLNAR Ingo wrote:

>i think the bug is a bit more complex. The actual 'corruption' is
>reproducible no matter what the standard output is.

Applying this patch to the file simple.c:

--- ../fork_debug/simple.c Sat Jun 20 23:16:38 1998
+++ simple.c Sun Jun 21 16:08:54 1998
@@ -4,6 +4,7 @@
*/

#include <sys/types.h>
+#include <sys/wait.h>
#include <stdio.h>
#include <unistd.h>
#include <string.h>
@@ -50,9 +51,13 @@
{
case 0: if(strcmp(webpage, "---BEGIN DATA---")==0)
{
+ int status;
pw_returnvalue++;
D2print(0, "Begin data\n");
+#if 1
if((err_r=fork())<1)die(err_r); /* MEMORY CORRUPTION detected here - depends on number of things... */
+ wait(&status);
+#endif
continue;
}
break;
@@ -66,7 +71,11 @@
D2print(0, "End of data\n");
continue;
} else {
+ int status;
+#if 0
if((err_r=fork())<1)die(err_r); /* the corruption will appear more likely here if not in the first one... */
+ wait(&status);
+#endif
D2print(0, "[%s]\n", webpage);
}
break;

7066 write(1, "Begin data\n", 11) = 11
^^^^^ this write is not on the screen here
7066 fork() = 7067
7066 wait4(-1, <unfinished ...>
7067 lseek(6, -2838, SEEK_CUR) = 1258
7067 munmap(0x400b4000, 4096) = 0
7067 munmap(0x400b5000, 4096) = 0
^^^^^^ the write is on the screen the fist time somewhere here
7067 _exit(0) = ?
7066 <... wait4 resumed> [WIFEXITED(s) && WEXITSTATUS(s) == 0], 0, NULL)
= 7067
7066 --- SIGCHLD (Child exited) ---
^^^^^^^ the write got duplicated somewhere here too
7066 write(1, "[00 ValidDataValidDataValidDataV"..., 87) = 87

show that the parent do a write() and _then_ libc must assume the data is
just on stdout, but really the data is not yet there and only when the
child exit() after the fork() the write happen on the screen, and this
cause duplication of the string since also the parent process will write
the same data then...

I don' t think this should happen, I think that the string should be
printed only at once.

Andrea[s] Arcangeli

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu