Bug 951391 - Signal 11 (SEGV) caught by ps, ps:display.c:66
Summary: Signal 11 (SEGV) caught by ps, ps:display.c:66
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: procps-ng
Version: 7.0
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: beta
: ---
Assignee: Jaromír Cápík
QA Contact: BaseOS QE - Apps
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-04-12 08:13 UTC by Jan Stancek
Modified: 2016-02-01 01:58 UTC (History)
4 users (show)

Fixed In Version: procps-ng-3.3.7-3.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-05-16 14:32:02 UTC


Attachments (Terms of Use)
ps_procps-ng-3.3.7-1.el7.x86_64_core.20031.bz2 (30.36 KB, application/octet-stream)
2013-04-12 08:16 UTC, Jan Stancek
no flags Details

Description Jan Stancek 2013-04-12 08:13:57 UTC
Description of problem:
"ps -p $pid" is randomly crashing:

+ /usr/bin/rhts-test-runner.sh
...
logger: /usr/bin/rhts-test-runner.sh rhts-test-update 127.0.0.1:7085 11871175 start  kernel-kernel-standards-pttest
Signal 11 (SEGV) caught by ps (procps-ng version 3.3.7).
ps:display.c:66: please report this bug

I could trigger the crash with following script while trying different usleep values:

---------------------
#!/bin/bash

ulimit -c unlimited
while [ True ]; do
  usleep 7000 &
  ps -p $!
done
---------------------

This issue now breaks beaker/rhts occasionally, because rhts-test-runner depends on "ps -p $pid".

Version-Release number of selected component (if applicable):
procps-ng-3.3.7-1.el7.x86_64

How reproducible:
sporadically

Steps to Reproduce:
1. try the simple script in description

Actual results:
ps crashes

Expected results:
ps never crashes

Additional info:

Comment 1 Jan Stancek 2013-04-12 08:16:49 UTC
Created attachment 734607 [details]
ps_procps-ng-3.3.7-1.el7.x86_64_core.20031.bz2

# gdb /bin/ps core.20031 
GNU gdb (GDB) Red Hat Enterprise Linux (7.5.91.20130402-15.el7)
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/ps...Reading symbols from /usr/lib/debug/usr/bin/ps.debug...done.
done.
[New LWP 20031]
Core was generated by `ps -p 20030'.
Program terminated with signal 11, Segmentation fault.
#0  __strrchr_sse42 () at ../sysdeps/x86_64/multiarch/strrchr.S:112
112		movdqa	(%r8), %xmm0
(gdb) bt full
#0  __strrchr_sse42 () at ../sysdeps/x86_64/multiarch/strrchr.S:112
No locals.
#1  0x00007ffb451c6e85 in stat2proc (S=0x1 <Address 0x1 out of bounds>, P=P@entry=0x615760 <buf.6243>) at readproc.c:476
        num = <optimized out>
        tmp = <optimized out>
#2  0x00007ffb451c83e6 in simple_readproc (PT=0x1f92570, p=0x615760 <buf.6243>) at readproc.c:774
        ub = {buf = 0x1f9a650 "", siz = 4096}
        sb = {st_dev = 3, st_ino = 488760, st_nlink = 8, st_mode = 16749, st_uid = 0, st_gid = 0, __pad0 = 0, st_rdev = 0, 
          st_size = 0, st_blksize = 1024, st_blocks = 0, st_atim = {tv_sec = 1365753789, tv_nsec = 49519444}, st_mtim = {
            tv_sec = 1365753789, tv_nsec = 49519444}, st_ctim = {tv_sec = 1365753789, tv_nsec = 49519444}, __unused = {0, 0, 0}}
        path = 0x1f925d0 "/proc/20030"
        flags = 96
#3  0x00007ffb451c8a9a in readproc (PT=PT@entry=0x1f92570, p=p@entry=0x615760 <buf.6243>) at readproc.c:1077
        ret = <optimized out>
        saved_p = 0x615760 <buf.6243>
#4  0x0000000000402b06 in simple_spew () at display.c:354
        ptp = 0x1f92570
        buf = {tid = 20030, ppid = 0, maj_delta = 0, min_delta = 0, pcpu = 0, state = 0 '\000', pad_1 = 0 '\000', pad_2 = 0 '\000', 
          pad_3 = 0 '\000', utime = 0, stime = 0, cutime = 0, cstime = 0, start_time = 0, signal = '\000' <repeats 17 times>, 
          blocked = '\000' <repeats 17 times>, sigignore = '\000' <repeats 17 times>, sigcatch = '\000' <repeats 17 times>, 
          _sigpnd = '\000' <repeats 17 times>, start_code = 0, end_code = 0, start_stack = 0, kstk_esp = 0, kstk_eip = 0, 
          wchan = 0, priority = 0, nice = 0, rss = 0, alarm = 0, size = 0, resident = 0, share = 0, trs = 0, lrs = 0, drs = 0, 
          dt = 0, vm_size = 0, vm_lock = 0, vm_rss = 0, vm_data = 0, vm_stack = 0, vm_swap = 0, vm_exe = 0, vm_lib = 0, 
          rtprio = 18446744073709551615, sched = 18446744073709551615, vsize = 0, rss_rlim = 0, flags = 0, min_flt = 0, 
          maj_flt = 0, cmin_flt = 0, cmaj_flt = 0, environ = 0x0, cmdline = 0x0, cgroup = 0x0, supgid = 0x0, supgrp = 0x0, 
          euser = '\000' <repeats 19 times>, ruser = '\000' <repeats 19 times>, suser = '\000' <repeats 19 times>, 
          fuser = '\000' <repeats 19 times>, rgroup = '\000' <repeats 19 times>, egroup = '\000' <repeats 19 times>, 
          sgroup = '\000' <repeats 19 times>, fgroup = '\000' <repeats 19 times>, cmd = '\000' <repeats 15 times>, ring = 0x0, 
          next = 0x0, pgrp = 0, session = 0, nlwp = 0, tgid = 20030, tty = 0, euid = 0, egid = 0, ruid = 0, rgid = 0, suid = 0, 
          sgid = 0, fuid = 0, fgid = 0, tpgid = 0, exit_signal = 0, processor = 0}
        buf2 = {tid = 0, ppid = 0, maj_delta = 0, min_delta = 0, pcpu = 0, state = 0 '\000', pad_1 = 0 '\000', pad_2 = 0 '\000', 
          pad_3 = 0 '\000', utime = 0, stime = 0, cutime = 0, cstime = 0, start_time = 0, signal = '\000' <repeats 17 times>, 
          blocked = '\000' <repeats 17 times>, sigignore = '\000' <repeats 17 times>, sigcatch = '\000' <repeats 17 times>, 
          _sigpnd = '\000' <repeats 17 times>, start_code = 0, end_code = 0, start_stack = 0, kstk_esp = 0, kstk_eip = 0, 
          wchan = 0, priority = 0, nice = 0, rss = 0, alarm = 0, size = 0, resident = 0, share = 0, trs = 0, lrs = 0, drs = 0, 
          dt = 0, vm_size = 0, vm_lock = 0, vm_rss = 0, vm_data = 0, vm_stack = 0, vm_swap = 0, vm_exe = 0, vm_lib = 0, rtprio = 0, 
          sched = 0, vsize = 0, rss_rlim = 0, flags = 0, min_flt = 0, maj_flt = 0, cmin_flt = 0, cmaj_flt = 0, environ = 0x0, 
          cmdline = 0x0, cgroup = 0x0, supgid = 0x0, supgrp = 0x0, euser = '\000' <repeats 19 times>, 
          ruser = '\000' <repeats 19 times>, suser = '\000' <repeats 19 times>, fuser = '\000' <repeats 19 times>, 
          rgroup = '\000' <repeats 19 times>, egroup = '\000' <repeats 19 times>, sgroup = '\000' <repeats 19 times>, 
---Type <return> to continue, or q <return> to quit---
          fgroup = '\000' <repeats 19 times>, cmd = '\000' <repeats 15 times>, ring = 0x0, next = 0x0, pgrp = 0, session = 0, 
          nlwp = 0, tgid = 0, tty = 0, euid = 0, egid = 0, ruid = 0, rgid = 0, suid = 0, sgid = 0, fuid = 0, fgid = 0, tpgid = 0, 
          exit_signal = 0, processor = 0}
#5  main (argc=3, argv=<optimized out>) at display.c:592
No locals.

Comment 3 Jan Stancek 2013-04-16 12:34:28 UTC
I think following commit fixed the issue in upstream:

commit 526bc5dfa924177e68be0123bd67e3370955f924
Author: Jim Warner <james.warner@comcast.net>
Date:   Sat Mar 30 00:00:00 2013 -0500
    library: avoid SEGV if file2str should read zero bytes

Comment 4 Jaromír Cápík 2013-04-16 15:28:12 UTC
Ahoj Honzo.

I'm just building a new release.
Thanks for the report.

Regards, Jaromir.

Comment 5 Jaromír Cápík 2013-04-17 12:15:55 UTC
Please, test procps-ng-3.3.7-3.el7 ...

Thx,
J.

Comment 6 Jan Stancek 2013-04-17 12:55:35 UTC
Works OK for me. Here's a better reproducer:

# rpm -qa procps-ng
procps-ng-3.3.7-1.el7.x86_64.rpm

# cat hook_open.c
-----------------------------------------------------------------------
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

// gcc -Wall -fPIC -shared -o hook_open.so hook_open.c

int open(const char *pathname, int flags, mode_t mode)
{
	if (strcmp(pathname, "/proc/1/stat") == 0) {
		printf("%s\n", pathname);
		return syscall(SYS_open, "/tmp/empty", flags, mode);
	}
	return syscall(SYS_open, pathname, flags, mode);
}
-----------------------------------------------------------------------

# touch /tmp/empty 
# LD_PRELOAD=./hook_open.so ps
/proc/1/stat
Signal 11 (SEGV) caught by ps (procps-ng version 3.3.7).
ps:display.c:66: please report this bug
Segmentation fault

# yum localupdate procps-ng-3.3.7-3.el7.x86_64.rpm
# touch /tmp/empty 
# LD_PRELOAD=./hook_open.so ps
/proc/1/stat
  PID TTY          TIME CMD
 4893 pts/1    00:00:00 ps
31826 pts/1    00:00:00 bash


Note You need to log in before you can comment on or make changes to this bug.