You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
61 lines
2.5 KiB
61 lines
2.5 KiB
commit b3a810d0d3d5c6ce7ddfb61321cd7971808ca703 |
|
Author: Stefan Liebler <stli@linux.vnet.ibm.com> |
|
Date: Tue May 17 10:45:48 2016 +0200 |
|
|
|
Fix tst-cancel17/tst-cancelx17, which sometimes segfaults while exiting. |
|
|
|
The testcase tst-cancel[x]17 ends sometimes with a segmentation fault. |
|
This happens in one of 10000 cases. Then the real testcase has already |
|
exited with success and returned from do_test(). The segmentation fault |
|
occurs after returning from main in _dl_fini(). |
|
|
|
In those cases, the aio_read(&a) was not canceled because the read |
|
request was already in progress. In the meanwhile aio_write(ap) wrote |
|
something to the pipe and the read request is able to read the |
|
requested byte. |
|
The read request hasn't finished before returning from do_test(). |
|
After it finishes, it writes the return value and error code from the |
|
read syscall to the struct aiocb a, which lies on the stack of do_test. |
|
The stack of the subsequent function call of _dl_fini or _dl_sort_fini, |
|
which is inlined in _dl_fini is corrupted. |
|
|
|
In case of S390, it reads a zero and decrements it by 1: |
|
unsigned int k = nmaps - 1; |
|
struct link_map **runp = maps[k]->l_initfini; |
|
The load from unmapped memory leads to the segmentation fault. |
|
The stack corruption also happens on other architectures. |
|
I saw them e.g. on x86 and ppc, too. |
|
|
|
This patch adds an aio_suspend call to ensure, that the read request |
|
is finished before returning from do_test(). |
|
|
|
ChangeLog: |
|
|
|
* nptl/tst-cancel17.c (do_test): Wait for finishing aio_read(&a). |
|
|
|
diff --git a/nptl/tst-cancel17.c b/nptl/tst-cancel17.c |
|
index fb89292..eedd28e 100644 |
|
--- a/nptl/tst-cancel17.c |
|
+++ b/nptl/tst-cancel17.c |
|
@@ -333,6 +333,22 @@ do_test (void) |
|
|
|
puts ("early cancellation succeeded"); |
|
|
|
+ if (ap == &a2) |
|
+ { |
|
+ /* The aio_read(&a) was not canceled because the read request was |
|
+ already in progress. In the meanwhile aio_write(ap) wrote something |
|
+ to the pipe and the read request either has already been finished or |
|
+ is able to read the requested byte. |
|
+ Wait for the read request before returning from this function because |
|
+ the return value and error code from the read syscall will be written |
|
+ to the struct aiocb a, which lies on the stack of this function. |
|
+ Otherwise the stack from subsequent function calls - e.g. _dl_fini - |
|
+ will be corrupted, which can lead to undefined behaviour like a |
|
+ segmentation fault. */ |
|
+ const struct aiocb *l[1] = { &a }; |
|
+ TEMP_FAILURE_RETRY (aio_suspend(l, 1, NULL)); |
|
+ } |
|
+ |
|
return 0; |
|
}
|
|
|