[Bug 211881] New: glic doesn't handle correct with parameter for some functions: timer_delete(), timer_getoverrun(), timer_gettime(), timer_settime()
https://bugzilla.novell.com/show_bug.cgi?id=211881 Summary: glic doesn't handle correct with parameter for some functions: timer_delete(), timer_getoverrun(), timer_gettime(), timer_settime() Product: SUSE Linux 10.1 Version: Final Platform: All OS/Version: SuSE Linux 10.1 Status: NEW Severity: Normal Priority: P5 - None Component: Development AssignedTo: pth@novell.com ReportedBy: yxu@novell.com QAContact: qa@suse.de an example testcase: #include <time.h> #include <stdio.h> #include <errno.h> #include "posixtest.h" int main(int argc, char *argv[]) { timer_t tid; int test=1; tid = (timer_t) test; if (timer_delete(tid) == -1) { if (errno==EINVAL) { printf("timer_delete() returned -1 and set errno=EINVAL\n"); return PTS_PASS; } else { printf("timer_delete() returned -1, but didn't set errno!=EINVAL\n"); return PTS_FAIL; } } printf("timer_delete() did not return -1\n"); return PTS_PASS; } It will give output segfault. And strace shows: execve("./5-1", ["./5-1"], [/* 93 vars */]) = 0 brk(0) = 0x804a000 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fa9000 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=160239, ...}) = 0 mmap2(NULL, 160239, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7f81000 close(3) = 0 open("/lib/libm.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\0004\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=180631, ...}) = 0 mmap2(NULL, 147584, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7f5c000 madvise(0xb7f5c000, 147584, MADV_SEQUENTIAL|0x1) = 0 mmap2(0xb7f7f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x22) = 0xb7f7f000 close(3) = 0 open("/lib/librt.so.1", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0p\35\0\000"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=40297, ...}) = 0 mmap2(NULL, 33356, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7f53000 madvise(0xb7f53000, 33356, MADV_SEQUENTIAL|0x1) = 0 mmap2(0xb7f5a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6) = 0xb7f5a000 close(3) = 0 open("/lib/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\300Y\1"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1404242, ...}) = 0 mmap2(NULL, 1176988, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7e33000 madvise(0xb7e33000, 1176988, MADV_SEQUENTIAL|0x1) = 0 mmap2(0xb7f4c000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x118) = 0xb7f4c000 mmap2(0xb7f50000, 9628, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f50000 close(3) = 0 open("/lib/libpthread.so.0", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\200K\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=100331, ...}) = 0 mmap2(NULL, 78304, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7e1f000 madvise(0xb7e1f000, 78304, MADV_SEQUENTIAL|0x1) = 0 mmap2(0xb7e2f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xf) = 0xb7e2f000 mmap2(0xb7e31000, 4576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7e31000 close(3) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7e1e000 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7e1d000 set_thread_area({entry_number:-1 -> 6, base_addr:0xb7e1d6b0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0 mprotect(0xb7f4c000, 8192, PROT_READ) = 0 munmap(0xb7f81000, 160239) = 0 set_tid_address(0xb7e1d6f8) = 13374 rt_sigaction(SIGRTMIN, {0xb7e23760, [], SA_SIGINFO}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {0xb7e23670, [], SA_RESTART|SA_SIGINFO}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM_INFINITY}) = 0 _sysctl({{CTL_KERN, KERN_VERSION}, 2, 0xbfccc740, 36, (nil), 0}) = 0 --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ Process 13374 detached If I didn't assign any value to variable "test", then it will succeed and return EINVAL as supposed to. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=211881 ------- Comment #1 from yxu@novell.com 2006-10-12 06:54 MST ------- Here is the output of strace when "test" isn't assigned any value: execve("./5-1", ["./5-1"], [/* 93 vars */]) = 0 brk(0) = 0x804a000 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f6a000 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=160239, ...}) = 0 mmap2(NULL, 160239, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7f42000 close(3) = 0 open("/lib/libm.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\0004\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=180631, ...}) = 0 mmap2(NULL, 147584, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7f1d000 madvise(0xb7f1d000, 147584, MADV_SEQUENTIAL|0x1) = 0 mmap2(0xb7f40000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x22) = 0xb7f40000 close(3) = 0 open("/lib/librt.so.1", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0p\35\0\000"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=40297, ...}) = 0 mmap2(NULL, 33356, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7f14000 madvise(0xb7f14000, 33356, MADV_SEQUENTIAL|0x1) = 0 mmap2(0xb7f1b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6) = 0xb7f1b000 close(3) = 0 open("/lib/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\300Y\1"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1404242, ...}) = 0 mmap2(NULL, 1176988, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7df4000 madvise(0xb7df4000, 1176988, MADV_SEQUENTIAL|0x1) = 0 mmap2(0xb7f0d000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x118) = 0xb7f0d000 mmap2(0xb7f11000, 9628, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f11000 close(3) = 0 open("/lib/libpthread.so.0", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\200K\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=100331, ...}) = 0 mmap2(NULL, 78304, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7de0000 madvise(0xb7de0000, 78304, MADV_SEQUENTIAL|0x1) = 0 mmap2(0xb7df0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xf) = 0xb7df0000 mmap2(0xb7df2000, 4576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7df2000 close(3) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7ddf000 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7dde000 set_thread_area({entry_number:-1 -> 6, base_addr:0xb7dde6b0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0 mprotect(0xb7f0d000, 8192, PROT_READ) = 0 munmap(0xb7f42000, 160239) = 0 set_tid_address(0xb7dde6f8) = 13908 rt_sigaction(SIGRTMIN, {0xb7de4760, [], SA_SIGINFO}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {0xb7de4670, [], SA_RESTART|SA_SIGINFO}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM_INFINITY}) = 0 _sysctl({{CTL_KERN, KERN_VERSION}, 2, 0xbfc1bea0, 36, (nil), 0}) = 0 timer_delete(0x20e85356) = -1 EINVAL (Invalid argument) fstat64(1, {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 7), ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f69000 write(1, "timer_delete() returned -1 and s"..., 48timer_delete() returned -1 and set errno=EINVAL ) = 48 exit_group(0) = ? Process 13908 detached -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=211881 mmarek@novell.com changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mmarek@novell.com ------- Comment #2 from mmarek@novell.com 2006-10-12 07:23 MST ------- AFAICS, the timer is a pointer internally, so there is no usable way to detect an invalid value. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=211881 pbaudis@novell.com changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED Summary|glic doesn't handle correct |timer_*() functions don't return EINVAL on |with parameter for some |invalid timer_id |functions: timer_delete(), | |timer_getoverrun(), | |timer_gettime(), | |timer_settime() | ------- Comment #5 from pbaudis@novell.com 2006-10-22 13:58 MST ------- I think fixing this would require changing the ABI, I will try to work with the upstream on fixing this. Thanks for the report. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=211881#c6 Petr Baudis <pbaudis@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |pkirsch@novell.com --- Comment #6 from Petr Baudis <pbaudis@novell.com> 2007-10-03 08:04:37 MST --- *** Bug 328898 has been marked as a duplicate of this bug. *** https://bugzilla.novell.com/show_bug.cgi?id=328898 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=211881#c7 Patrick Kirsch <pkirsch@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|Normal |Major --- Comment #7 from Patrick Kirsch <pkirsch@novell.com> 2007-10-10 02:14:05 MST --- host: quake110 package: glibc-2.4-31.30 product: SLES-10-SP1 This time some of the timer_* (timer_delete, timer_gettime) functions return SIGSEGV: (e.g. 5-1 from open_posix_testsuite/conformance/interfaces/timer_delete/speculative/5-1.c) quake110:~/ltp # gdb -r 5-1 GNU gdb 6.6 (gdb) r Starting program: /root/ltp/5-1 [Thread debugging using libthread_db enabled] [New Thread 47336313564960 (LWP 5280)] Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 47336313564960 (LWP 5280)] 0x00002b0d57e2e049 in timer_delete@@GLIBC_2.3.3 () from /lib64/librt.so.1 (gdb) bt #0 0x00002b0d57e2e049 in timer_delete@@GLIBC_2.3.3 () from /lib64/librt.so.1 #1 0x00000000004005f8 in main (argc=1, argv=0x7fff52d99f28) at 5-1.c:26 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠novell.com