RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 951391 - Signal 11 (SEGV) caught by ps, ps:display.c:66
Summary: Signal 11 (SEGV) caught by ps, ps:display.c:66
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: procps-ng
Version: 7.0
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: beta
: ---
Assignee: Jaromír Cápík
QA Contact: BaseOS QE - Apps
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-04-12 08:13 UTC by Jan Stancek
Modified: 2016-02-01 01:58 UTC (History)
4 users (show)

Fixed In Version: procps-ng-3.3.7-3.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-05-16 14:32:02 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
ps_procps-ng-3.3.7-1.el7.x86_64_core.20031.bz2 (30.36 KB, application/octet-stream)
2013-04-12 08:16 UTC, Jan Stancek 		no flags Details
View All

Description Jan Stancek 2013-04-12 08:13:57 UTC 
Description of problem:
"ps -p $pid" is randomly crashing:

+ /usr/bin/rhts-test-runner.sh
...
logger: /usr/bin/rhts-test-runner.sh rhts-test-update 127.0.0.1:7085 11871175 start  kernel-kernel-standards-pttest
Signal 11 (SEGV) caught by ps (procps-ng version 3.3.7).
ps:display.c:66: please report this bug

I could trigger the crash with following script while trying different usleep values:

---------------------
#!/bin/bash

ulimit -c unlimited
while [ True ]; do
  usleep 7000 &
  ps -p $!
done
---------------------

This issue now breaks beaker/rhts occasionally, because rhts-test-runner depends on "ps -p $pid".

Version-Release number of selected component (if applicable):
procps-ng-3.3.7-1.el7.x86_64

How reproducible:
sporadically

Steps to Reproduce:
1. try the simple script in description

Actual results:
ps crashes

Expected results:
ps never crashes

Additional info:
Comment 1 Jan Stancek 2013-04-12 08:16:49 UTC 
Created attachment 734607 [details]
ps_procps-ng-3.3.7-1.el7.x86_64_core.20031.bz2

# gdb /bin/ps core.20031 
GNU gdb (GDB) Red Hat Enterprise Linux (7.5.91.20130402-15.el7)
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/ps...Reading symbols from /usr/lib/debug/usr/bin/ps.debug...done.
done.
[New LWP 20031]
Core was generated by `ps -p 20030'.
Program terminated with signal 11, Segmentation fault.
#0  __strrchr_sse42 () at ../sysdeps/x86_64/multiarch/strrchr.S:112
112		movdqa	(%r8), %xmm0
(gdb) bt full
#0  __strrchr_sse42 () at ../sysdeps/x86_64/multiarch/strrchr.S:112
No locals.
#1  0x00007ffb451c6e85 in stat2proc (S=0x1 <Address 0x1 out of bounds>, P=P@entry=0x615760 <buf.6243>) at readproc.c:476
        num = <optimized out>
        tmp = <optimized out>
#2  0x00007ffb451c83e6 in simple_readproc (PT=0x1f92570, p=0x615760 <buf.6243>) at readproc.c:774
        ub = {buf = 0x1f9a650 "", siz = 4096}
        sb = {st_dev = 3, st_ino = 488760, st_nlink = 8, st_mode = 16749, st_uid = 0, st_gid = 0, __pad0 = 0, st_rdev = 0, 
          st_size = 0, st_blksize = 1024, st_blocks = 0, st_atim = {tv_sec = 1365753789, tv_nsec = 49519444}, st_mtim = {
            tv_sec = 1365753789, tv_nsec = 49519444}, st_ctim = {tv_sec = 1365753789, tv_nsec = 49519444}, __unused = {0, 0, 0}}
        path = 0x1f925d0 "/proc/20030"
        flags = 96
#3  0x00007ffb451c8a9a in readproc (PT=PT@entry=0x1f92570, p=p@entry=0x615760 <buf.6243>) at readproc.c:1077
        ret = <optimized out>
        saved_p = 0x615760 <buf.6243>
#4  0x0000000000402b06 in simple_spew () at display.c:354
        ptp = 0x1f92570
        buf = {tid = 20030, ppid = 0, maj_delta = 0, min_delta = 0, pcpu = 0, state = 0 '\000', pad_1 = 0 '\000', pad_2 = 0 '\000', 
          pad_3 = 0 '\000', utime = 0, stime = 0, cutime = 0, cstime = 0, start_time = 0, signal = '\000' <repeats 17 times>, 
          blocked = '\000' <repeats 17 times>, sigignore = '\000' <repeats 17 times>, sigcatch = '\000' <repeats 17 times>, 
          _sigpnd = '\000' <repeats 17 times>, start_code = 0, end_code = 0, start_stack = 0, kstk_esp = 0, kstk_eip = 0, 
          wchan = 0, priority = 0, nice = 0, rss = 0, alarm = 0, size = 0, resident = 0, share = 0, trs = 0, lrs = 0, drs = 0, 
          dt = 0, vm_size = 0, vm_lock = 0, vm_rss = 0, vm_data = 0, vm_stack = 0, vm_swap = 0, vm_exe = 0, vm_lib = 0, 
          rtprio = 18446744073709551615, sched = 18446744073709551615, vsize = 0, rss_rlim = 0, flags = 0, min_flt = 0, 
          maj_flt = 0, cmin_flt = 0, cmaj_flt = 0, environ = 0x0, cmdline = 0x0, cgroup = 0x0, supgid = 0x0, supgrp = 0x0, 
          euser = '\000' <repeats 19 times>, ruser = '\000' <repeats 19 times>, suser = '\000' <repeats 19 times>, 
          fuser = '\000' <repeats 19 times>, rgroup = '\000' <repeats 19 times>, egroup = '\000' <repeats 19 times>, 
          sgroup = '\000' <repeats 19 times>, fgroup = '\000' <repeats 19 times>, cmd = '\000' <repeats 15 times>, ring = 0x0, 
          next = 0x0, pgrp = 0, session = 0, nlwp = 0, tgid = 20030, tty = 0, euid = 0, egid = 0, ruid = 0, rgid = 0, suid = 0, 
          sgid = 0, fuid = 0, fgid = 0, tpgid = 0, exit_signal = 0, processor = 0}
        buf2 = {tid = 0, ppid = 0, maj_delta = 0, min_delta = 0, pcpu = 0, state = 0 '\000', pad_1 = 0 '\000', pad_2 = 0 '\000', 
          pad_3 = 0 '\000', utime = 0, stime = 0, cutime = 0, cstime = 0, start_time = 0, signal = '\000' <repeats 17 times>, 
          blocked = '\000' <repeats 17 times>, sigignore = '\000' <repeats 17 times>, sigcatch = '\000' <repeats 17 times>, 
          _sigpnd = '\000' <repeats 17 times>, start_code = 0, end_code = 0, start_stack = 0, kstk_esp = 0, kstk_eip = 0, 
          wchan = 0, priority = 0, nice = 0, rss = 0, alarm = 0, size = 0, resident = 0, share = 0, trs = 0, lrs = 0, drs = 0, 
          dt = 0, vm_size = 0, vm_lock = 0, vm_rss = 0, vm_data = 0, vm_stack = 0, vm_swap = 0, vm_exe = 0, vm_lib = 0, rtprio = 0, 
          sched = 0, vsize = 0, rss_rlim = 0, flags = 0, min_flt = 0, maj_flt = 0, cmin_flt = 0, cmaj_flt = 0, environ = 0x0, 
          cmdline = 0x0, cgroup = 0x0, supgid = 0x0, supgrp = 0x0, euser = '\000' <repeats 19 times>, 
          ruser = '\000' <repeats 19 times>, suser = '\000' <repeats 19 times>, fuser = '\000' <repeats 19 times>, 
          rgroup = '\000' <repeats 19 times>, egroup = '\000' <repeats 19 times>, sgroup = '\000' <repeats 19 times>, 
---Type <return> to continue, or q <return> to quit---
          fgroup = '\000' <repeats 19 times>, cmd = '\000' <repeats 15 times>, ring = 0x0, next = 0x0, pgrp = 0, session = 0, 
          nlwp = 0, tgid = 0, tty = 0, euid = 0, egid = 0, ruid = 0, rgid = 0, suid = 0, sgid = 0, fuid = 0, fgid = 0, tpgid = 0, 
          exit_signal = 0, processor = 0}
#5  main (argc=3, argv=<optimized out>) at display.c:592
No locals.
Comment 3 Jan Stancek 2013-04-16 12:34:28 UTC 
I think following commit fixed the issue in upstream:

commit 526bc5dfa924177e68be0123bd67e3370955f924
Author: Jim Warner <james.warner>
Date:   Sat Mar 30 00:00:00 2013 -0500
    library: avoid SEGV if file2str should read zero bytes
Comment 4 Jaromír Cápík 2013-04-16 15:28:12 UTC 
Ahoj Honzo.

I'm just building a new release.
Thanks for the report.

Regards, Jaromir.
Comment 5 Jaromír Cápík 2013-04-17 12:15:55 UTC 
Please, test procps-ng-3.3.7-3.el7 ...

Thx,
J.
Comment 6 Jan Stancek 2013-04-17 12:55:35 UTC 
Works OK for me. Here's a better reproducer:

# rpm -qa procps-ng
procps-ng-3.3.7-1.el7.x86_64.rpm

# cat hook_open.c
-----------------------------------------------------------------------
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

// gcc -Wall -fPIC -shared -o hook_open.so hook_open.c

int open(const char *pathname, int flags, mode_t mode)
{
	if (strcmp(pathname, "/proc/1/stat") == 0) {
		printf("%s\n", pathname);
		return syscall(SYS_open, "/tmp/empty", flags, mode);
	}
	return syscall(SYS_open, pathname, flags, mode);
}
-----------------------------------------------------------------------

# touch /tmp/empty 
# LD_PRELOAD=./hook_open.so ps
/proc/1/stat
Signal 11 (SEGV) caught by ps (procps-ng version 3.3.7).
ps:display.c:66: please report this bug
Segmentation fault

# yum localupdate procps-ng-3.3.7-3.el7.x86_64.rpm
# touch /tmp/empty 
# LD_PRELOAD=./hook_open.so ps
/proc/1/stat
  PID TTY          TIME CMD
 4893 pts/1    00:00:00 ps
31826 pts/1    00:00:00 bash
Note You need to log in before you can comment on or make changes to this bug.