[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <873ax7ua9j.fsf@hades.wkstn.nix>
Date: Fri, 21 Sep 2007 19:46:32 +0100
From: Nix <nix@...eri.org.uk>
To: "J. Bruce Fields" <bfields@...ldses.org>
Cc: linux-kernel@...r.kernel.org
Subject: Re: [2.6.22.6] nfsd: fh_verify() `malloc failure' with lots of free memory leads to NFS hang
On 18 Sep 2007, J. Bruce Fields told this:
> Also I suppose we should check which version of nfs-utils that fix is in
> and make sure distributions are getting the fixed nfs-utils before they
> get the new libc, or we're going to see this bug a lot....
Further info. This behaviour, although it is allowed by POSIX, is not
*specified*, as such, by it (ah! ambiguity! life would be so dull
without you!), and is not replicated by any other C library on the face
of the planet.
Further, it's not even the behaviour of glibc, as such.
It's the behaviour of glibc 2.6.x as patched with this Debian-specific
patch:
,----[ any/submitted-fileops-and-signals.diff ]
| Index: glibc-2.6/libio/fileops.c
| ===================================================================
| --- glibc-2.6.orig/libio/fileops.c
| +++ glibc-2.6/libio/fileops.c
| @@ -517,10 +517,19 @@
| fp->_cur_column = INTUSE(_IO_adjust_column) (fp->_cur_column - 1, data,
| count) + 1;
| _IO_setg (fp, fp->_IO_buf_base, fp->_IO_buf_base, fp->_IO_buf_base);
| - fp->_IO_write_base = fp->_IO_write_ptr = fp->_IO_buf_base;
| - fp->_IO_write_end = (fp->_mode <= 0
| + if (__builtin_expect (count == to_do, 1))
| + {
| + fp->_IO_write_base = fp->_IO_write_ptr = fp->_IO_buf_base;
| + fp->_IO_write_end = (fp->_mode <= 0
| && (fp->_flags & (_IO_LINE_BUF+_IO_UNBUFFERED))
| ? fp->_IO_buf_base : fp->_IO_buf_end);
| + }
| + else if (count > 0 && fp->_IO_write_base == data)
| + {
| + memmove (data, data+count,
| + fp->_IO_write_ptr - fp->_IO_write_base - count);
| + fp->_IO_write_ptr -= count;
| + }
| return count;
| }
|
`----
This patch also breaks at least bash and zsh as well as nfs-utils (see
<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=429021>) and I sort of
suspect it's not long for this world as a result.
So this is much less nasty than we feared (well, and more nasty if you
happen to be a Debian unstable or testing user).
--
`Some people don't think performance issues are "real bugs", and I think
such people shouldn't be allowed to program.' --- Linus Torvalds
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists