2013-08-19 18:48:11

by Emmanuel Benisty

[permalink] [raw]
Subject: commit 94fc5d9: chromium-sandbox core dumped

Hi,

The following commit breaks chromium on my machine:

commit 94fc5d9de5bd757ad46f0d94bc4ebf617c4487f6
Author: Richard Genoud <[email protected]>
Date: Mon Aug 19 18:30:31 2013 +0200

proc: return on proc_readdir error

Chromium breaks with:

[269:269:0819/203839:FATAL:zygote_host_impl_linux.cc(195)] Check
failed: pid_0. Did not find zygote process (using sandbox binary
/usr/lib/chromium/chromium-sandbox)
Aborted (core dumped)

Thanks in advance.
-- Emmanuel


2013-08-19 20:25:13

by Linus Torvalds

[permalink] [raw]
Subject: Re: commit 94fc5d9: chromium-sandbox core dumped

On Mon, Aug 19, 2013 at 11:48 AM, Emmanuel Benisty <[email protected]> wrote:
>
> The following commit breaks chromium on my machine ("proc:
> return on proc_readdir error")
>
> Chromium breaks with:
>
> [269:269:0819/203839:FATAL:zygote_host_impl_linux.cc(195)] Check
> failed: pid_0. Did not find zygote process (using sandbox binary
> /usr/lib/chromium/chromium-sandbox)
> Aborted (core dumped)

Hmm. I think that Richard's patch is correct, but looking at all this,
it looks like the return value of proc_readdir() is broken.

The comment above proc_readdir_de() says

* This returns non-zero if at EOF, so that the /proc
* root directory can use this and check if it should
* continue with the <pid> entries..

which is exactly what it should do. But the *code* does no such thing,
and instead always returns 0, breaking Richards patch.

I suspect that last "return 0" at the end should be "return 1". Does
that fix things for you? Untested.

Al? It looks to me like commit f0c3b5093add ("[readdir] convert
procfs") messed up when it changed proc_readdir_de() to not have all
those "goto out" things any more...

Linus

2013-08-19 23:26:06

by Linus Torvalds

[permalink] [raw]
Subject: Re: commit 94fc5d9: chromium-sandbox core dumped

On Mon, Aug 19, 2013 at 1:25 PM, Linus Torvalds
<[email protected]> wrote:
>
> I suspect that last "return 0" at the end should be "return 1". Does
> that fix things for you? Untested.

Ok. Confirmed. I reproduced the bug that Richard Genoud fixed, and
also verified that yes, changing that last "return 0" in
proc_readdir_de() to "return 1" fixes the bug that Emmanuel reported.
Although I just did it with a special test-program using different
getdents buffer sizes, so I didn't verify the particular Chromium
breakage, but that does look like it's the same issue.

Linus

2013-08-20 07:29:20

by Emmanuel Benisty

[permalink] [raw]
Subject: Re: commit 94fc5d9: chromium-sandbox core dumped

Hi Linus,

On Tue, Aug 20, 2013 at 1:26 AM, Linus Torvalds
<[email protected]> wrote:
> On Mon, Aug 19, 2013 at 1:25 PM, Linus Torvalds
> <[email protected]> wrote:
>>
>> I suspect that last "return 0" at the end should be "return 1". Does
>> that fix things for you? Untested.
>
> Ok. Confirmed. I reproduced the bug that Richard Genoud fixed, and
> also verified that yes, changing that last "return 0" in
> proc_readdir_de() to "return 1" fixes the bug that Emmanuel reported.
> Although I just did it with a special test-program using different
> getdents buffer sizes, so I didn't verify the particular Chromium
> breakage, but that does look like it's the same issue.

Just to confirm it does fix the chromium issue as well.

Thanks.
-- Emmanuel