Bug 521200

Summary: ps aborted with "double free or corruption"
Product: Red Hat Enterprise Linux 4 Reporter: Tomas Smetana <tsmetana>
Component: procpsAssignee: Jan Görig <jgorig>
Status: CLOSED ERRATA QA Contact: Petr Šplíchal <psplicha>
Severity: urgent Docs Contact:
Priority: urgent    
Version: 4.8CC: albert, cward, fnadge, james.brown, jcaruso, jwest, moshiro, ohudlick, ovasik, psplicha, rbiba, tao
Target Milestone: rcKeywords: OtherQA, ZStream
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: procps-3.2.3-8.18 Doc Type: Bug Fix
Doc Text:
Previously, an incomplete condition in ps could cause it to access the wrong memory. Due to this behavior, ps could fail and unexpectedly close. This update adds a condition in the code, and ps no longer fails.
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-02-16 14:31:14 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 485811, 596759    
Attachments:
Description Flags
Backported patch from bug #487700 none

Description Tomas Smetana 2009-09-04 09:37:03 UTC
Description of problem:
The ps command sometimes crashes with the "double free or corruption" glibc error.

Version-Release number of selected component (if applicable):
procps-3.2.3-8.9

How reproducible:
Can't reproduce

Steps to Reproduce:
1. run "ps -e -o user -o pid -o ppid -o args"
  
Actual results:
Abort.

Expected results:
Normal run.

Additional info:
We are not able to reproduce the behaviour, however the reproducer in the customer's environment is the very same as in the bug #487700 and so is the fix (already tested and confirmed by the customer).  This is essentially a request to include the fix for bug #487700 also in the RHEL-4 procps.

Comment 1 Tomas Smetana 2009-09-04 09:38:34 UTC
Created attachment 359778 [details]
Backported patch from bug #487700

Tested and confirmed to fix the problem by the customer.

Comment 2 John Caruso 2009-09-09 19:05:45 UTC
We're seeing this bug as well on RHEL 4.8 with procps-3.2.3-8.17, and the reproducer from Bug 487700 works for us as well (and it didn't work the first few times, so if it's not working for you just keep trying it).  So please do include the fix in RHEL4's procps.

Comment 3 Siddhesh Poyarekar 2010-04-09 08:55:10 UTC
Bug 487700 comment 6 has a reproducer for this.

Comment 24 Florian Nadge 2011-01-12 13:39:21 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause:

Consequence:

Fix:

Result:

Comment 25 Jan Görig 2011-01-12 16:15:27 UTC
    Technical note updated. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    Diffed Contents:
@@ -1,7 +1,8 @@
 Cause:
-
+Uncomplete condition in ps.
 Consequence:
-
+ps crashes due to access to wrong memory
 Fix:
-
+Added additional condition.
-Result:+Result:
+ps doesn't crash now.

Comment 26 Florian Nadge 2011-01-13 12:21:11 UTC
    Technical note updated. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    Diffed Contents:
@@ -1,8 +1 @@
-Cause:
+Previously, an incomplete condition in ps could cause it to access the wrong memory. Due to this behavior, ps could fail and unexpectedly close. This update adds a condition in the code, and ps no longer fails.-Uncomplete condition in ps.
-Consequence:
-ps crashes due to access to wrong memory
-Fix:
-Added additional condition.
-Result:
-ps doesn't crash now.

Comment 27 errata-xmlrpc 2011-02-16 14:31:14 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0249.html