Opened 15 years ago

Closed 15 years ago

#4106 closed bug (fixed)

mmap() doesn't zero the last page

Reported by: zooey Owned by: axeld
Priority: normal Milestone: R1
Component: System/Kernel Version: R1/pre-alpha1
Keywords: Cc: grzegorz.dabrowski@…, planche2k@…
Blocked By: Blocking:
Platform: All

Description

According to POSIX, mmap() is supposed to fill the area in the last page that is not "covered" by the mapped file with zeros.

Our mmap does not do this, which causes gcc's fixincl program to crash, as it relies on these zeros to be there in order to invoke strlen(). If there's no zero in the "empty" area of the last page, strlen will try to access the following page and segfault.

The current implementation seems to just read the corresponding BFS block(s) until all pages have been filled, as fixincl always crashes with the same file, but will not crash on a copy of that file (which obviously happens to have a trailing zero somewhere).

This is with hrev31642.

Attachments (1)

mmap_zero_test.cpp (1.4 KB ) - added by zooey 15 years ago.

Download all attachments as: .zip

Change History (10)

comment:1 by bonefish, 15 years ago

BFS (respectively any FS) isn't reponsible for clearing the unused part of the last page. At least that was the idea. ATM VMVnodeCache::Read() (the VM subsystem's interface to mapped files) clears the respective memory, but the file cache (respectively the VFS functions it uses) doesn't as far as I can see.

comment:2 by kaliber, 15 years ago

Cc: grzegorz.dabrowski@… added

comment:3 by axeld, 15 years ago

Status: newassigned

comment:4 by axeld, 15 years ago

Resolution: fixed
Status: assignedclosed

Fixed in hrev31669.

comment:5 by zooey, 15 years ago

Resolution: fixed
Status: closedreopened

Reopening, since the problem is still present.

I'm going to attach a little test program, which exposes the bug.

by zooey, 15 years ago

Attachment: mmap_zero_test.cpp added

comment:6 by andreasf, 15 years ago

Cc: planche2k@… added

This could explain some weird Mono behavior I encountered...

comment:7 by axeld, 15 years ago

Status: reopenednew

This is actually a different bug with the same outcome, though; it should only affect the truncation case.

comment:8 by axeld, 15 years ago

Status: newassigned

comment:9 by axeld, 15 years ago

Resolution: fixed
Status: assignedclosed

Fixed in hrev31732, and thanks for the test app!

Note: See TracTickets for help on using tickets.