Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
For bugs related to Red Hat Enterprise Linux 5 product line. The current stable release is 5.10. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 474148

Summary: Segfault when no "-mno-tls-direct-seg-refs" for Fortran/OpenMP test case
Product: Red Hat Enterprise Linux 5 Reporter: Michal Nowak <mnowak>
Component: kernel-xenAssignee: Xen Maintainance List <xen-maint>
Status: CLOSED DUPLICATE QA Contact: Martin Jenner <mjenner>
Severity: medium Docs Contact:
Priority: medium    
Version: 5.3CC: clalance, ohudlick
Target Milestone: rcKeywords: Reopened
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: kernel-xen-2.6.18-126.el5 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-07-08 12:32:56 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Michal Nowak 2008-12-02 14:35:34 UTC
Description of problem:

From the `man gcc':

       -mno-tls-direct-seg-refs
           Controls whether TLS variables may be accessed with offsets from the 
           TLS segment register (%gs for 32-bit, %fs for 64-bit), or whether 
           the thread base pointer must be added.  Whether or not this is legal
           depends on the operating system, and whether it maps the segment to
           cover the entire TLS area.

           For systems that use GNU libc, the default is on.


Consider this test case:

program foo
        implicit none
        common /bobcom/ bob(2)
!$omp threadprivate (/bobcom/)

        integer i
        real*8 bob

        do i=1,2
        write(*,*) i
        bob(i)=0.0d0
        enddo

        end program


Compile it:

  gfortran -o reproducer -fopenmp reproducer.f90

or

  gfortran43 -o reproducer -fopenmp reproducer.f90


And run:

newman@dhcp-lab-198 445666-OpenMP-segv $ ./reproducer 
           1
Segmentation fault


Plus output from the kernel ring buffer:

Dec  2 15:31:11 dhcp-lab-198 kernel: 4gb seg fixup, process reproducer (pid 6069), cs:ip 73:00a0758d

Version-Release number of selected component (if applicable):

kernel-xen-2.6.18-124.el5

How reproducible:
always


Expected results:

Run slowly but without Segfault.

Additional info:

newman@dhcp-lab-198 445666-OpenMP-segv $  gfortran -o reproducer -fopenmp reproducer.f90 -mno-tls-direct-seg-refs
newman@dhcp-lab-198 445666-OpenMP-segv $ ./reproducer 
           1
           2

From GDB:

Run -> Segfault -> bt -> i r
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

gdb) bt
#0  0x08048659 in MAIN__ ()
#1  0x080486b7 in main ()


gdb) i r
eax            0x1	1
ecx            0x0	0
edx            0x0	0
ebx            0xbfd19cf0	-1076781840
esp            0xbfd19cd0	0xbfd19cd0
ebp            0xbfd19e08	0xbfd19e08
esi            0xa13cc0	10566848
edi            0x0	0
eip            0x8048659	0x8048659 <MAIN__+133>
eflags         0x210282	[ SF IF RF ID ]
cs             0x73	115
ss             0x7b	123
ds             0x7b	123
es             0x7b	123
fs             0x0	0
gs             0x33	51



(gdb) disas $pc-32 $pc+32
Dump of assembler code from 0x8048639 to 0x8048679:
0x08048639 <MAIN__+101>:	and    $0x8,%al
0x0804863b <MAIN__+103>:	add    $0x0,%al
0x0804863d <MAIN__+105>:	add    %al,(%eax)
0x0804863f <MAIN__+107>:	lea    -0x8(%ebp),%eax
0x08048642 <MAIN__+110>:	mov    %eax,0x4(%esp)
0x08048646 <MAIN__+114>:	mov    %ebx,(%esp)
0x08048649 <MAIN__+117>:	call   0x80484a8 <_gfortran_transfer_integer@plt>
0x0804864e <MAIN__+122>:	mov    %ebx,(%esp)
0x08048651 <MAIN__+125>:	call   0x8048488 <_gfortran_st_write_done@plt>
0x08048656 <MAIN__+130>:	mov    -0x8(%ebp),%eax
0x08048659 <MAIN__+133>:	movl   $0x0,%gs:-0x18(,%eax,8)
0x08048665 <MAIN__+145>:	movl   $0x0,%gs:-0x14(,%eax,8)
0x08048671 <MAIN__+157>:	lea    0x1(%eax),%edx
0x08048674 <MAIN__+160>:	mov    %edx,-0x8(%ebp)
0x08048677 <MAIN__+163>:	cmp    $0x2,%eax
End of assembler dump.