From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 25394 invoked by alias); 29 Jun 2011 13:54:33 -0000 Received: (qmail 25384 invoked by uid 22791); 29 Jun 2011 13:54:32 -0000 X-SWARE-Spam-Status: No, hits=-1.9 required=5.0 tests=AWL,BAYES_00,SPF_HELO_PASS X-Spam-Check-By: sourceware.org Received: from mpv2.tis.cwru.edu (HELO mpv2.tis.cwru.edu) (129.22.105.37) by sourceware.org (qpsmtpd/0.43rc1) with ESMTP; Wed, 29 Jun 2011 13:54:15 +0000 Received: from mpv5.cwru.edu (mpv5.tis.CWRU.Edu [129.22.105.51]) by mpv2.tis.cwru.edu (MOS 4.2.3-GA) with ESMTP id BAI98869; Wed, 29 Jun 2011 09:54:12 -0400 Received: from caleb.INS.CWRU.Edu (caleb.INS.CWRU.Edu [129.22.8.211]) by mpv5.cwru.edu (MOS 4.2.3-GA) with ESMTP id AFX00327 (AUTH cpr); Wed, 29 Jun 2011 09:54:15 -0400 Message-ID: <4E0B2E83.9030202@case.edu> Date: Wed, 29 Jun 2011 13:54:00 -0000 From: Chet Ramey Reply-To: chet.ramey@case.edu User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2.18) Gecko/20110616 Thunderbird/3.1.11 MIME-Version: 1.0 To: Jan Kratochvil CC: bug-readline@gnu.org, gdb-patches@sourceware.org, Sterling Augustine Subject: Re: [Bug-readline] [readline patch, gdb-7.3?] Avoid free from a signal handler [Re: [PATCH] Make interrupting tab-completion safe.] References: <20110612121158.GA10611@host1.jankratochvil.net> <20110626222146.GA4410@host1.jankratochvil.net> In-Reply-To: <20110626222146.GA4410@host1.jankratochvil.net> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Junkmail-Signature-Raw: score=unknown, refid=str=0001.0A020209.4E0B2E85.016D,ss=1,fgs=0, ip=0.0.0.0, so=2010-12-23 16:51:53, dmn=2009-09-10 00:05:08, mode=single engine Mailing-List: contact gdb-patches-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: gdb-patches-owner@sourceware.org X-SW-Source: 2011-06/txt/msg00446.txt.bz2 On 6/26/11 6:21 PM, Jan Kratochvil wrote: > GDB reproducer for the readline bug: > ------------------------------------ > > On Mon, 13 Jun 2011 19:44:57 +0200, Sterling Augustine wrote: >> gdb itself isn't big enough to make it easy to reproduce (~24k >> symbols). > > The goal is to do very many memory allocation functions in GDB, no matter > which ones. I found for example libwebkitgtk.so.debug as good sample data, > optionally added .gdb_index is OK for faster startup, it should contain C++ > functions for more memory operations (therefore GDB itself is not usable as > the sample data). Used this GDB .exp file, reproducible in several seconds: > > set binfile "/home/jkratoch/t/rh575292-gdbindex.debug" > gdb_exit > gdb_start > gdb_load ${binfile} > while 1 { > send_gdb "b \t\t" > sleep 0.1 > send_gdb "\003" > gdb_test "" "^b \\^CQuit" "Quit seen" > } > > b ^CQuit > (gdb) PASS: gdb.base/quit.exp: Quit seen > b *** glibc detected *** /home/jkratoch/redhat/gdb-clean/gdb/testsuite/../../gdb/gdb: munmap_chunk(): invalid pointer: 0x0000000005b950b0 *** > > One can also add stub expensive mallinfo calls into GDB xmalloc/xfree/etc. for > better reproducibility. > > > The readline bug: > ----------------- > > readline now calls memory allocation/free functions from the readline signal > handler. This is not permitted by POSIX and it does corrupt memory such as > during SiGINT: > > #0 __lll_lock_wait_private () at ../nptl/sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:100 > #1 in _L_lock_10461 () from /lib64/libc.so.6 > #2 in __libc_malloc (bytes=139919578014176) at malloc.c:3657 > #3 in __libc_message (do_abort=2, fmt=0x7f41909aebe8 "*** glibc detected *** %s: %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:137 > #4 in malloc_printerr (action=3, str=0x7f41909aec18 "munmap_chunk(): invalid pointer", ptr=) at malloc.c:6283 > #5 in xfree (ptr=0x5b950b0) at utils.c:1303 > #6 in rl_free_undo_list () at undo.c:119 > #7 in rl_free_line_state () at signals.c:503 > #8 in _rl_handle_signal (sig=2) at signals.c:188 > #9 in rl_signal_handler (sig=2) at signals.c:149 > #10 > #11 _int_malloc (av=0x7f4190bea1e0, bytes=177) at malloc.c:4727 > #12 in __libc_malloc (bytes=177) at malloc.c:3660 > #13 in reallochook (ptr=, size=128, caller=0xd6f531) at mcheck.c:335 > #14 in d_growable_string_resize (dgs=0x7fff34b0d150, need=122) at ./cp-demangle.c:3247 > #15 in d_growable_string_init (dgs=0x7fff34b0d150, estimate=122) at ./cp-demangle.c:3226 > #16 in cplus_demangle_print (options=3, dc=0x4114fe8, estimate=122, palc=0x7fff34b0d198) at ./cp-demangle.c:3416 > #17 in cp_comp_to_string (result=0x4114fe8, estimated_len=122) at cp-name-parser.y:1965 > #18 in cp_canonicalize_string (string=0x93f4e20 "WebCore::FrameLoader::loadProvisionalItemFromCachedPage(void)") at cp-support.c:139 > [...] > > Unfortunately it leaks a bit now and also for example during SIGWINCH readline > calls xmalloc which cannot be ignored/delayed so easily as xfree. > > Please postpone any memory management function only after the signal handler. If you feel that you need to make this change for the current version of gdb, go ahead. I will keep going in the direction readline-6.2 began: using the RL_CHECK_SIGNALS macro to run signal handling code outside the signal handler and minimizing the use of _rl_interrupt_immediately without destroying performance. The big problem is to allow operations that read through the file system (like completion) to be interrupted without running unsafe functions from a signal handler. Wrapping completion functions is the current remaining use of _rl_interrupt_immediately. It does the user no good to keep setting the "I got SIGINT" flag if he's trying to complete files on a dead or otherwise unreachable file server. Chet -- ``The lyf so short, the craft so long to lerne.'' - Chaucer ``Ars longa, vita brevis'' - Hippocrates Chet Ramey, ITS, CWRU chet@case.edu http://cnswww.cns.cwru.edu/~chet/