paraslash - network audio streaming tools https://git.tue.mpg.de/cgit/paraslash/atom?h=v0.3 2009-11-05T23:21:16Z 2009-11-05T23:21:16Z Andre Noll maan@systemlinux.org 2009-11-05T23:21:16Z urn:sha1:06c82519ac27d0c34e1b6e0c1a1f088fe34e61b3 glibc-2.11 revealed the following bug in init_afs(): The assignment mmd->afs_pid = fork(); results in undefined behaviour because fork() returns twice and mmd->afs_pid lives in a shared memory area. Depending on whether the child runs first, this results in mmd->afs_pid being either zero or the pid of the afs child process. mmd->afs_pid being zero seems to happen always with glibc-2.11 and has rather strange consequences: First, it causes para_server attempt to kill process 0 instead of the afs process on exit. This fails because para_server never runs as root. However, it may result in dirty osl tables as the afs process might access mmd after the shared memory area containing mmd has already been destroyed. Second, para_server fails to notice the death of the afs process, which is really bad and may cause tons of error messages being written to the log. Fix this bug by temporarily storing the afs pid in a local variable and setting mmd->afs_pid only in the server (parent) process. 2009-05-10T18:41:11Z Andre Noll maan@systemlinux.org 2009-05-10T18:41:11Z urn:sha1:f8f6605a4f02a15378a36618dbfacfc862fc6192 2009-04-26T19:05:18Z Andre Noll maan@systemlinux.org 2009-04-26T19:05:18Z urn:sha1:7ad440cc721a097ecff7aa3f38f22806c644a497 2009-04-26T17:45:59Z Andre Noll maan@systemlinux.org 2009-04-26T17:45:59Z urn:sha1:a0b1604a44be6bb89c91ae760f1ccf00768eb09a The server process must wait for afs because afs catches SIGINT/SIGTERM and may thus not respond immediately to these SIGNALS. Before reacting to the signal, afs might want to use the shared memory area and the mmd mutex. If the server process destroys this mutex too early and afs tries to lock the shared memory area, the call to mutex_lock() will fail and terminate the afs process. This leads to dirty osl tables. There's no such problem with the other children of the server process (the command handlers) as these reset their SIGINT/SIGTERM handlers to the default action, i.e. these processes get killed immediately by the above kill(). 2009-04-26T16:08:13Z Andre Noll maan@systemlinux.org 2009-04-26T16:08:13Z urn:sha1:ad81d625737e1c096c154aedd8a1d161d3ee592e The chunk table and the info_string are pointers located in the mmd struct that point to dynamically allocated memory that must be freed by the parent and the child. However, as the mmd struct is in a shared memory area, there's no guarantee that after the fork these pointers are still valid in child context. As these two pointers are not used in the child anyway, we save them to local variables and free the memory via that copy in the child. This gets rid of *** glibc detected *** para_server (serving 127.0.0.1#53650): double free or corruption (!prev): 0x08086fe0 *** 2009-04-06T17:02:16Z Andre Noll maan@systemlinux.org 2009-04-06T17:02:16Z urn:sha1:3781a3df94ce9bb28c98369df7a140fb4c086c23 Also, make para_sigaction() and para_install_sighandler() return void and exit on errors. 2009-04-06T16:54:15Z Andre Noll maan@systemlinux.org 2009-04-06T16:54:15Z urn:sha1:96c5cc23d6d1e8ecfb6eacee7eaf19efe51e89bc 2009-03-22T12:58:28Z Andre Noll maan@systemlinux.org 2009-03-22T12:58:28Z urn:sha1:46f2f102fa22ddffe515546e7db21cf208db0d90 In fact, there was only one "real" leak: An empty info string (100 bytes) could leak on file change. 2009-03-21T16:46:43Z Andre Noll maan@systemlinux.org 2009-03-21T16:46:43Z urn:sha1:ab6470e0146493969887781bc8efd5a615f879c7 If afs dies immediately on startup (because of dirty tables) para_server would not notice as the SIGCHLD handler is being intalled after the call to afs_init(). 2009-02-04T21:27:29Z Andre Noll maan@systemlinux.org 2009-02-04T21:27:29Z urn:sha1:0ea88fa418c5133f8add1c2eabdd3369942cc77e Otherwise, afs might get killed by SIGUSR1 before it gets a chance to ignore this signal.