Opened 10 years ago

Closed 10 years ago

#4106 closed bug (fixed)

mmap() doesn't zero the last page

Reported by: zooey Owned by: axeld
Priority: normal Milestone: R1
Component: System/Kernel Version: R1/pre-alpha1
Keywords: Cc: grzegorz.dabrowski@…, planche2k@…
Blocked By: Blocking:
Has a Patch: no Platform: All

Description

According to POSIX, mmap() is supposed to fill the area in the last page that is not "covered" by the mapped file with zeros.

Our mmap does not do this, which causes gcc's fixincl program to crash, as it relies on these zeros to be there in order to invoke strlen(). If there's no zero in the "empty" area of the last page, strlen will try to access the following page and segfault.

The current implementation seems to just read the corresponding BFS block(s) until all pages have been filled, as fixincl always crashes with the same file, but will not crash on a copy of that file (which obviously happens to have a trailing zero somewhere).

This is with hrev31642.

Attachments (1)

mmap_zero_test.cpp (1.4 KB) - added by zooey 10 years ago.

Download all attachments as: .zip

Change History (10)

comment:1 Changed 10 years ago by bonefish

BFS (respectively any FS) isn't reponsible for clearing the unused part of the last page. At least that was the idea. ATM VMVnodeCache::Read() (the VM subsystem's interface to mapped files) clears the respective memory, but the file cache (respectively the VFS functions it uses) doesn't as far as I can see.

comment:2 Changed 10 years ago by kaliber

Cc: grzegorz.dabrowski@… added

comment:3 Changed 10 years ago by axeld

Status: newassigned

comment:4 Changed 10 years ago by axeld

Resolution: fixed
Status: assignedclosed

Fixed in hrev31669.

comment:5 Changed 10 years ago by zooey

Resolution: fixed
Status: closedreopened

Reopening, since the problem is still present.

I'm going to attach a little test program, which exposes the bug.

Changed 10 years ago by zooey

Attachment: mmap_zero_test.cpp added

comment:6 Changed 10 years ago by andreasf

Cc: planche2k@… added

This could explain some weird Mono behavior I encountered...

comment:7 Changed 10 years ago by axeld

Status: reopenednew

This is actually a different bug with the same outcome, though; it should only affect the truncation case.

comment:8 Changed 10 years ago by axeld

Status: newassigned

comment:9 Changed 10 years ago by axeld

Resolution: fixed
Status: assignedclosed

Fixed in hrev31732, and thanks for the test app!

Note: See TracTickets for help on using tickets.