Bug 847730

Created attachment 603965 [details]
module files needed to reproduce this problem, patch that fixes it

Description of problem:

"module load" segfaults in some cases. I have traced this to the precompiled regular expressions kept in static storage in utility.c::ReturnValue. The TCL manual disallows this:

http://www.tcl.tk/man/tcl/TclLib/RegExp.htm:

"Note: the return value from Tcl_RegExpCompile is only valid up to the next call to Tcl_RegExpCompile; it is not safe to retain these values for long periods of time."

This rejected upstream bug is related:

http://sourceforge.net/tracker/?func=detail&aid=1685498&group_id=15538&atid=115538

Version-Release number of selected component (if applicable):

[jr76@pc0072 modulepath]$ rpm -qa environment-modules
environment-modules-3.2.7b-6.el6.x86_64

This bug is still present in the latest upstream.

How reproducible:

Intermittent, pointer refers to freed heap memory so may depend on environment variables.

Steps to Reproduce:

export MODULEPATH=/scratch/modulepath/modulefiles
# included in tgz

valgrind /usr/bin/modulecmd bash load fast_dp

OR

# included in tgz
gdb /usr/bin/modulecmd
run bash load fast_dp
 
Actual results:

==20842== Invalid write of size 8
==20842==    at 0x4CE71C9: Tcl_RegExpExec (tclRegexp.c:197)
==20842==    by 0x411C54: ReturnValue (utility.c:3008)
==20842==    by 0x409804: Execute_TclFile (cmdModule.c:612)
==20842==    by 0x405B5A: ModuleCmd_Load (ModuleCmd_Load.c:213)
==20842==    by 0x40A0E9: cmdModule (cmdModule.c:217)
==20842==    by 0x4C5B5FE: TclInvokeStringCommand (tclBasic.c:2146)
==20842==    by 0x4C5C692: TclEvalObjvInternal (tclBasic.c:3690)
==20842==    by 0x4CA4793: TclExecuteByteCode (tclExecute.c:2348)
==20842==    by 0x4CAB968: TclCompEvalObj (tclExecute.c:1474)
==20842==    by 0x4C5DC95: TclEvalObjEx (tclBasic.c:5095)
==20842==    by 0x4C6EBB2: Tcl_IfObjCmd (tclCmdIL.c:307)
==20842==    by 0x4C5C692: TclEvalObjvInternal (tclBasic.c:3690)
==20842==  Address 0x50887b0 is 64 bytes inside a block of size 120 free'd
==20842==    at 0x4A0595D: free (vg_replace_malloc.c:366)
==20842==    by 0x4CE6EBF: CompileRegexp (tclRegexp.c:979)
==20842==    by 0x40B795: cmdSetPath (cmdPath.c:259)
==20842==    by 0x4123B9: Update_LoadedList (utility.c:2124)
==20842==    by 0x405C62: ModuleCmd_Load (ModuleCmd_Load.c:228)
==20842==    by 0x40A0E9: cmdModule (cmdModule.c:217)
==20842==    by 0x4C5B5FE: TclInvokeStringCommand (tclBasic.c:2146)
==20842==    by 0x4C5C692: TclEvalObjvInternal (tclBasic.c:3690)
==20842==    by 0x4CA4793: TclExecuteByteCode (tclExecute.c:2348)
==20842==    by 0x4CAB968: TclCompEvalObj (tclExecute.c:1474)
==20842==    by 0x4C5DC95: TclEvalObjEx (tclBasic.c:5095)
==20842==    by 0x4C6EBB2: Tcl_IfObjCmd (tclCmdIL.c:307)


(gdb) run bash load fast_dp
Starting program: /usr/bin/modulecmd bash load fast_dp
Detaching after fork from child process 28657.
Detaching after fork from child process 28658.
Detaching after fork from child process 28675.
Detaching after fork from child process 28697.

Program received signal SIGSEGV, Segmentation fault.
0x00000000006c2dd8 in ?? ()
Missing separate debuginfos, use: debuginfo-install glibc-2.12-1.80.el6_3.3.x86_64 libX11-1.3-2.el6.x86_64 libXau-1.0.5-1.el6.x86_64 libxcb-1.5-1.el6.x86_64
(gdb) bt 5
#0  0x00000000006c2dd8 in ?? ()
#1  0x00007ffff7cf5cfc in Tcl_DeleteCommandFromToken (interp=0x6c2c00, cmd=0x68f940)
    at /usr/src/debug/tcl8.5.7/generic/tclBasic.c:2838
#2  0x00007ffff7d67b64 in TclTeardownNamespace (nsPtr=0x6c7d00)
    at /usr/src/debug/tcl8.5.7/generic/tclNamesp.c:1087
#3  0x00007ffff7cf6cc0 in DeleteInterpProc (interp=0x6c2c00) at /usr/src/debug/tcl8.5.7/generic/tclBasic.c:1254
#4  0x0000000000405b98 in ModuleCmd_Load (interp=<value optimized out>, load=1, argc=1, 
    argv=<value optimized out>) at ModuleCmd_Load.c:268
(More stack frames follow...)
(gdb) 

Expected results:

Various bash commands to stdout, no SIGSEGV:

BALBES_ROOT=/dls_sw/apps/ccp4/64/6.2.0/7dec2011/ccp4-6.2.0/share/BALBES/Package ;export BALBES_ROOT;BINSORT_SCR=/home/jr76/tmp ;export BINSORT_SCR;CBIN=/dls_sw/apps/ccp4/64/6.2.0/7dec2011/ccp4-6.2.0/bin ;export CBIN;CCP4=/dls_sw/apps/ccp4/64/6.2.0/7dec2011/ccp4-6.2.0 ;export CCP4;CCP4I_HELP=/dls_sw/apps/ccp4/64/6.2.0/7dec2011/ccp4-6.2.0/ccp4i/help ;export CCP4I_HELP;CCP4I_TCLTK=/dls_sw/dasc/TclTkBlt/bin ;export CCP4I_TCLTK;CCP4I_TOP=/dls_sw/apps/ccp4/64/6.2.0/7dec2011/ccp4-6.2.0/ccp4i ;export CCP4I_TOP;CCP4_BIN=/dls_sw/apps/ccp4/64/6.2.0/7dec2011/ccp4-6.2.0/bin ;export CCP4_BIN;CCP4_BROWSER=firefox ;export CCP4_BROWSER;CCP4_HELPDIR=/dls_sw/apps/ccp4/64/6.2.0/7dec2011/ccp4-6.2.0/help/ ;export CCP4_HELPDIR;CCP4_LIB=/dls_sw/apps/ccp4/64/6.2.0/7dec2011/ccp4-6.2.0/lib ;export CCP4_LIB;CCP4_MASTER=/dls_sw/apps/ccp4/64/6.2.0/7dec2011 ;export CCP4_MASTER;CCP4_OPEN=UNKNOWN ;export CCP4_OPEN;CCP4_SCR=/home/jr76/tmp ;export CCP4_SCR

etc.


Additional info:

Attached patch which fixes this problem, and modules directory