Nayoa,
Thanks for your answer.
On 17 Jul 14:35, Horiguchi, Naoya wrote:
> I tried some simple operation (below) on 3.14.12, but not reproduced the crash,
> so some non-trivial condition seemed to trigger this.
> Could you elaborate about how you reproduced the crash?
Well, It's just a bunch of fairly random unit tests and I was not able
to make it happen on a small program. However, I modified your program
a bit and managed to reproduce the problem:
$ cat heap.c
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
int main() {
int i;
char *p = malloc(4096*512);
for (i = 0; i < 512; i++)
p[i*4096] = '1';
printf("p %p\n", p);
for (i = 0 ; i < 10; i++)
if (!fork()) {
memset(p, '2', 4096*512);
p = malloc(4096*512);
printf("pid %d\n", getpid());
memset(p, '3', 4096*512);
free(p);
return 0;
}
pause();
}
This is what happens on my 3.14.12 machine:
$ export HUGETLB_MORECORE=yes ; export HUGETLB_NO_PREFAULT= ; hugectl --heap ./h
p 0x800010
pid 7974
pid 7975
h: malloc.c:2369: sysmalloc: Assertion `(old_top == (((mbinptr) (((char *) &((av)->bins[((1) - 1) * 2])) - __builtin_offsetof (struct malloc_chunk, fd)))) && old_size == 0) || ((unsigned long) (old_size) >= (unsigned long)((((__builtin_offsetof (struct malloc_chunk, fd_nextsize))+((2 * (sizeof(size_t))) - 1)) & ~((2 * (sizeof(size_t))) - 1))) && ((old_top)->size & 0x1) && ((unsigned long)old_end & pagemask) == 0)' failed.
Sometimes the process gets stuck instead asserting out. But I could not
make it SIGSEGV
Same result with the 3.4.98 kernel.
It works fine when I remove your patch though
Guillaume.
--
Guillaume Morin <guillaume@xxxxxxxxxxx>
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html