Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 2029758

Summary: stap invocation causing std::bad_alloc
Product: Red Hat Enterprise Linux 8 Reporter: Martin Cermak <mcermak>
Component: systemtapAssignee: Frank Ch. Eigler <fche>
systemtap sub component: system-version QA Contact: Martin Cermak <mcermak>
Status: CLOSED ERRATA Docs Contact:
Severity: unspecified    
Priority: unspecified CC: dsmith, lberk, mcermak, mjw, scox, szidek, wcohen
Version: 8.6Keywords: Bugfix, Triaged
Target Milestone: rcFlags: pm-rhel: mirror+
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: systemtap-4.7-1.el8 Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-11-08 09:35:22 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Martin Cermak 2021-12-07 09:03:18 UTC
The qe testcase [1] is, on some test boxes, causing either SEGV, or 
std::bad_alloc.  

If debuginfod is used, the behavior is like this:

scr0   8.6 Server x86_64 # stap -v -g fork.stp -c "./ssh.exp bz1028643 bbb"
Pass 1: parsed user script and 483 library scripts using 295260virt/96148res/18180shr/79780data kb, in 230usr/100sys/1172real ms.
[SymtabCodeSource.C] FATAL: can't create Symtab object for file /boot/vmlinuz-4.18.0-353.el8.x86_64
Segmentation fault (core dumped)
(139) scr0   8.6 Server x86_64 # 


If locally installed debuginfo is used, the behavior is like this:


scr0   8.6 Server x86_64 # stap -v -g fork.stp -c "./ssh.exp bz1028643 bbb"
Pass 1: parsed user script and 483 library scripts using 295256virt/95932res/17964shr/79776data kb, in 190usr/60sys/785real ms.
std::bad_alloc
(1) scr0   8.6 Server x86_64 #


Test evironment: kernel-4.18.0-353.el8.x86_64, systemtap-4.6-2.el8.x86_64 1minutetip test box [2]

-----------------------------
[1] http://pkgs.devel.redhat.com/cgit/tests/openssh/tree/Regression/bz1028643-Connection-remains-when-fork-fails
[2] https://wiki.test.redhat.com/BaseOs/Projects/1minuteTIP

Comment 1 William Cohen 2021-12-08 15:43:21 UTC
There looks to be two issues involved with this:
- The liveness analysis code isn't proper determining it can't read the compress binary
- When the vmlinux is installed and the binary is read the liveness analysis ends up taking quite a bit of memory to run and runs out of memory

There is an upstream dyninst question discussing how to resolve these issues:
https://github.com/dyninst/dyninst/issues/1168

Comment 2 William Cohen 2021-12-20 01:35:10 UTC
There appears to be 5 sub-issues:
-Correctly punt analysis if can't find/read binary
-When debuginfod running get elf_path to binary as
 /boot/vmlinuz-4.18.0-353.el8.x86_64,
 but using locally installed kernel-debuginfo get
 /usr/lib/debug/lib/modules/4.18.0-353.el8.x86_64/vmlinux
-Handle compressed kernels
-Handle compressed modules
-Memory efficiency
  In this particular bug the dyninst parser is trying to parse the entire vmlinux
  rather than just on demand.  There has been some discussion in the upstream dyninst issue
  about this, https://github.com/dyninst/dyninst/issues/1168.  However, the dyninst
  on-demand parsing requires a recompile of dyninst with another option set to
  replace the existing parsing and these has not been exercised in a while.  Tried some
  experiments on a qemu VM and reproducer was able to successfully complete with
  8GB of memory (using about 70% of available memory).

Comment 3 Frank Ch. Eigler 2021-12-21 00:47:36 UTC
> -When debuginfod running get elf_path to binary as
>  /boot/vmlinuz-4.18.0-353.el8.x86_64,
>  but using locally installed kernel-debuginfo get
>  /usr/lib/debug/lib/modules/4.18.0-353.el8.x86_64/vmlinux

Why is this a problem?

> -Memory efficiency
>  [...]

Yes, it'd be nice to get dyninst more efficient here.

Let's add this simple item to the todo list:

- a bad_alloc() exception should be caught by systemtap around the dyninst call(s),
  so we have a chance at releasing dyninst data, printing a diagnostic, and
  continuing work

Comment 4 William Cohen 2022-01-18 03:17:27 UTC
Have a proposed patch on https://sourceware.org/git/?p=systemtap.git;a=shortlog;h=refs/heads/wcohen/liveness_mem_use to address this issue.

With the code from the branch compiled rather than getting the exception get the following with the reproducer:

$ ../install/bin/stap -p2 -v -g fork.stp 
Pass 1: parsed user script and 497 library scripts using 351948virt/152412res/17948shr/136876data kb, in 290usr/40sys/391real ms.
WARNING: unable to allocate memory for liveness of /usr/lib/debug/lib/modules/4.18.0-359.el8.x86_64/vmlinux: identifier '$return' at fork.stp:26:13
 source:             $return = -1
                     ^
# globals
sshd_fork_count:long
fork_to_fail:long = 1
# functions
execname:string ()
{ %{ /* pure */ /* unprivileged */ /* stable */
	strlcpy (STAP_RETVALUE, current->comm, MAXSTRINGLEN);
%} }
pid:long ()
{ return %{ /* pure */ /* unprivileged */ /* stable */ current->tgid %} }
ppid:long ()
{ %{ /* pure */ /* unprivileged */ /* stable */
#if defined(STAPCONF_REAL_PARENT)
	STAP_RETVALUE = current->real_parent->tgid;
#else
	STAP_RETVALUE = current->parent->tgid;
#endif
%} }
__private_fork_stp__dwarf_tvar_get_child_tidptr_4:long ()
{ return @kregister(8) }
__private_fork_stp__dwarf_tvar_get_clone_flags_0:long ()
{ return @kregister(5) }
__private_fork_stp__dwarf_tvar_get_parent_tidptr_3:long ()
{ return @kregister(2) }
__private_fork_stp__dwarf_tvar_get_return_6:long ()
{ return @kregister(0) }
__private_fork_stp__dwarf_tvar_get_stack_size_2:long ()
{ return @kregister(1) }
__private_fork_stp__dwarf_tvar_get_stack_start_1:long ()
{ return @kregister(4) }
__private_fork_stp__dwarf_tvar_get_tls_5:long ()
{ return @kregister(9) }
__private_fork_stp__dwarf_tvar_set_return_8:long (rvalue:long)
{ return (@kregister(0)) = (rvalue) }
# probes
begin /* <- begin */
{ printf("Started\\n\\n") }
kernel.function("_do_fork@kernel/fork.c:2340").call /* pc=_stext+0xeb5c0 */ /* <- kernel.function("_do_fork@kernel/fork.c:2340").call */
{ if ((execname()) == ("sshd")) {
(__global_sshd_fork_count)++;
printf(">>>%s[%5d] %s\\n", execname(), pid(), sprintf("clone_flags=%#x stack_start=%#x stack_size=%#x parent_tidptr=%#x child_tidptr=%#x tls=%#x", __private_fork_stp__dwarf_tvar_get_clone_flags_0(), __private_fork_stp__dwarf_tvar_get_stack_start_1(), __private_fork_stp__dwarf_tvar_get_stack_size_2(), __private_fork_stp__dwarf_tvar_get_parent_tidptr_3(), __private_fork_stp__dwarf_tvar_get_child_tidptr_4(), __private_fork_stp__dwarf_tvar_get_tls_5()));
printf("  PPID=%d\\n", ppid());
printf("  sshd_fork_count=%d\\n", __global_sshd_fork_count);
}
 }
kernel.function("_do_fork@kernel/fork.c:2340").return /* pc=_stext+0xeb5c0 */ /* <- kernel.function("_do_fork@kernel/fork.c:2340").return */
{ if ((execname()) == ("sshd")) {
printf("<<<%s[%5d] %s\\n", execname(), pid(), sprintf("return=%#x", __private_fork_stp__dwarf_tvar_get_return_6()));
printf("  PPID=%d\\n", ppid());
printf("  RETURN:%d\\n\\n", __private_fork_stp__dwarf_tvar_get_return_6());
if ((__global_sshd_fork_count) == (__global_fork_to_fail)) {
printf("!!! fork() will return -1\\n");
__private_fork_stp__dwarf_tvar_set_return_8(-1);
}
;
}
 }
Pass 2: analyzed script: 3 probes, 11 functions, 0 embeds, 2 globals using 3597308virt/250144res/4888shr/3382236data kb, in 3550usr/4850sys/33988real ms.

Comment 9 errata-xmlrpc 2022-11-08 09:35:22 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (systemtap bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:7538